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OVERSIGHT  OF  THE  YEAR  2000  PROBLEM: 
THE  Y2K  STATUS  OF  THE  DEPARTMENT  OF 
HEALTH  AND  HUMAN  SERVICES 


FRIDAY,  FEBRUARY  26,  1999 

House  of  Representatives, 
Subcommittee  on  Government  Management, 
Information,  and  Technology, 
Committee  on  Government  Reform, 

Washington,  DC. 
The  subcommittee  met,  pursuant  to  notice,  at  9  a.m.,  in  room 
2154,  Rayburn  House  Office  Building,  Hon.  Stephen  Horn  (chair- 
man of  the  subcommittee)  presiding. 
Present:  Representatives  Horn,  Morella,  Biggert,  and  Turner. 
Also  present:  Representive  Gordon. 

Staff  present:  J.  Russell  George,  staff  director  and  chief  counsel; 
Matt  Ryan,  senior  policy  director;  Bonnie  Heald,  director  of  infor- 
mation, and  professional  staff  member;  Mason  Alinger,  clerk;  Paul 
Wicker,  Kacey  Baker,  and  Richard  Lukas,  interns;  Michelle  Ash 
and  Faith  Weiss,  minority  counsels;  Ellen  Rayner,  minority  chief 
clerk;  and  Jean  Gosa  and  Earley  Green,  minority  staff  assistants. 

Mr.  Horn.  The  Subcommittee  on  Government  Management,  In- 
formation, and  Technology  will  come  to  order. 

There  are  only  308  days  left  to  reassure  American  citizens  that 
the  computer  systems,  those  that  are  critical  to  our  lives,  are  year 
2000  compliant.  Unfortunately,  even  today,  many  private  organiza- 
tions and  governmental  entities  are  only  now  recognizing  the  po- 
tential severity  of  this  problem.  Some  are  just  starting  to  fix  their 
systems,  leaving  little,  if  any,  time  for  one  of  the  most  important 
aspects  of  this  effort — adequate  testing. 

The  problem  is  real,  the  consequences  serious,  and  the  deadline 
is  unmovable. 

The  House  Subcommittee  on  Government  Management,  Informa- 
tion, and  Technology  has  focused  on  the  potential  problem  since 
early  1996.  On  Monday,  our  subcommittee  issued  its  seventh  report 
card,  which  showed  considerable  improvement  throughout  the  Fed- 
eral Government.  However,  much  work  still  remains.  We  will  con- 
tinue to  steadfastly  monitor  the  Federal  Government's  year  2000 
readiness  and  sternly  prod  those  departments  and  agencies  that 
lag  behind. 

Today  we  will  hear  about  the  status  of  year  2000  technology  ini- 
tiatives at  the  Department  of  Health  and  Human  Services  [HHS], 
and  one  of  its  key  components,  the  Health  Care  Financing  Admin- 
istration, otherwise  known  as  HCFA. 
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Since  November,  and  as  shown  in  our  most  recent  report  card, 
HHS  has  reported  substantial  improvement  in  making  its  mission 
critical  systems  year  2000  compliant.  Currently,  HHS  reports  that 
about  83  percent  of  its  mission  critical  systems  are  compliant,  due 
in  large  part  to  HCFA's  reported  increase  in  mission  critical  system 
compliance.  We  look  forward  this  morning  to  learning  how  HHS 
righted  itself  in  grappling  with  its  year  2000  issues. 

In  addition,  we  will  hear  from  the  General  Accounting  Office, 
Congress'  auditing  arm  on  program  and  money,  which  has  been 
doing  outstanding  work  for  this  subcommittee  over  the  last  3  years 
on  this  issue. 

The  Department  of  Health  and  Human  Services  provides  vital 
services  to  the  American  public,  ranging  from  health  care  and  food 
safety  to  AIDS  research.  In  addition,  the  Health  Care  Financing 
Administration  approves  more  than  $300  billion  annually  in  medi- 
cal bills  for  over  72  million  of  America's  most  vulnerable  citizens, 
the  elderly,  the  poor  and  the  sick.  But  will  these  payments  con- 
tinue on  January  1st?  How  year  2000  ready  is  HCFA  and  how 
ready  are  the  numerous  health  care  contractors  and  providers  in- 
volved in  Medicare? 

Finally,  how  prepared  are  the  States  for  providing  Medicaid  serv- 
ices to  the  nearly  35  million  people  who  otherwise  could  not  afford 
to  seek  medical  help.  No  Federal  entity  is  an  island  unto  itself  and 
no  Federal  entity  can  be  complacent  regardless  of  its  Y2K  status 
until  its  partner  organizations,  in  this  case  the  doctors,  hospitals 
and  the  State  and  local  governments,  are  also  adequately  prepared 
for  the  new  millennium.  HHS  is  also  responsible  for  processing 
about  $170  billion  a  year  in  Federal  grants  through  its  large  pay- 
ment management  system.  This  centralized  system  processes  most 
Federal  assistance  grants,  including  block  grants,  to  over  20,000  re- 
cipient accounts.  For  example,  this  system  processes  98  percent,  or 
about  $95  billion,  of  the  Federal  Government's  share  of  Medicaid 
grants.  The  big  concern  for  us  in  Congress  is  that  this  critically  im- 
portant system  is  not  yet  year  2000  compliant. 

I  look  forward  to  delving  into  these  and  other  highly  important 
issues  this  morning.  I  welcome  today's  witnesses  and  look  forward 
to  their  testimony. 

We  have  a  total  of  three  witnesses  for  this  hearing  and  we  are 
going  to  start  with  panel  one,  being  Joel  Willemssen,  the  Director 
of  Civil  Agencies,  Information  Systems,  General  Accounting  Office. 
Panel  two  will  then  come  up,  John  J.  Callahan,  the  Chief  Informa- 
tion Officer  for  the  Department  of  Health  and  Human  Services,  and 
Nancy-Ann  DeParle,  Administrator  of  HCFA. 

I  would  now  like  to  yield  to  Mr,  Gordon,  the  ranking  member  on 
the  Committee  on  Technology  of  the  House  Committee  on  Science. 
The  gentleman  from  Tennessee. 

Mr.  Gordon.  Thank  you,  Mr.  Chairman.  I  have  a  constituent  at 
home  by  the  name  of  Barbara  Mandrell.  She  had  a  song  a  few 
years  ago  entitled,  "I  Was  Country  Before  Country  Was  Cool"  and 
let  me  just  say  that  Steve  Horn  has  been  singing  the  problem  of 
Y2K  long  before  it  was  cool,  and  we  owe  you  a  debt  of  gratitude 
in  raising  this  awareness  in  our  country.  I  was  with  the  EU  last 
week  and  I  was  dismayed  when  we  talked  with  many  of  their  par- 
liamentarians that  for  some  reason  they  think  that  this  problem  is 
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going  to  go  away.  I  want  to  thank  you  for  putting  this  country  on 
notice,  and  I  think  your  report  cards  help  us  all  to  better  focus. 

Mr.  Horn.  I  now  yield  for  an  opening  statement  to  a  new  Mem- 
ber from  Illinois,  the  vice  chairman  of  the  Subcommittee  on  Gov- 
ernment Management,  Information,  and  Technology,  Mrs.  Biggert. 

Mrs.  Biggert.  Thank  you,  Chairman  Horn.  You  always  start  on 
time  to  the  very  minute,  and  we  always  appreciate  that.  This  cer- 
tainly is  an  important  issue  and  I  look  forward  to  the  testimony. 
I  think  that — how  many  days  do  we  have  now,  about  310? 

Mr.  Horn.  308. 

Mrs.  Biggert.  So  the  year  2000  is  not  going  to  wait  and  I  look 
forward  to  these  hearings.  And  I  think  that  the  more  hearings  that 
we  have,  the  more  education  that  we  have  on  this  issue,  the  more 
that  we  raise  the  consciousness  of  the  American  people  and  the  im- 
portance for  all  industry,  government,  local  government  and  Fed- 
eral Government  and  State  government,  to  really  assure  us  that  we 
are  going  to  be  ready  for  the  year  2000. 

Thank  you. 

Mr.  Horn.  Thank  you.  And  we  now  have  as  our  first  witness  and 
I  think  you  all  know  the  routine.  All  of  the  subcommittees  of  the 
Government  Reform  Committee  swear  in  all  witnesses,  and  we  will 
start  with  you,  Mr.  Willemssen. 

[Witness  sworn.] 

Mr.  Horn.  The  clerk  will  note  that  the  witness  affirmed  and  we 
will  begin  with  this  overview  and  then  ask  panel  two  to  join  us  and 
have  their  testimony,  and  then  it  will  be  essentially  a  dialog  of  the 
committee  and  the  witnesses. 

Let  me  just  withhold,  the  distinguished  ranking  member  from 
Texas,  Mr.  Turner,  is  here.  Do  you  have  an  opening  statement?  He 
is  always  a  constructive  member  of  this  committee. 

Mr.  Turner.  Thank  you,  Mr.  Chairman.  I  want  to  thank  you, 
first  of  all,  for  holding  this  hearing,  both  you  and  Chairwoman 
Morelia  have  been  active  in  leadership  in  this  area. 

We  are  here  to  discuss  the  efforts  of  the  Department  of  Health 
and  Human  Services  to  resolve  the  year  2000  problem.  In  Septem- 
ber 1998,  the  General  Accounting  Office  reported  that  HCFA  and 
its  contractors  were  behind  schedule  in  testing,  repairing,  and  im- 
plementing the  systems  that  support  Medicare.  At  that  time,  the 
GAO  concluded  that  it  was  highly  unlikely  that  the  Medicare  sys- 
tems would  be  compliant  in  time  to  ensure  uninterrupted  delivery 
of  benefits  and  services. 

Even  as  recently  as  February  of  this  year  we  have  learned  that 
only  54  of  the  78  contractor  systems  were  compliant  and  5  of  these 
24  noncompliant  systems  were  more  than  2  months  behind  sched- 
ule. We  have  additionally  learned  that  while  HCFAs  contractors 
have  made  progress,  seven  are  at  risk  of  missing  the  federally  im- 
posed March  31st  deadline. 

In  addition,  HCFA  has  been  in  the  process  of  determining  wheth- 
er to  update  its  current  payment  management  system  or  to  use  a 
new  system.  The  payment  management  system  processes  about 
$170  billion  annually  or  about  75  percent  of  all  Federal  grant  and 
aid  programs,  and  HCFA  has  chosen  to  update  and  maintain  this 
system  through  the  year  2000.  Given  the  time  spent  in  making  this 
determination,  Y2K  efforts  to  test  this  system  did  not  begin  until 
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later  than  expected,  and  HCFA  will  be  conducting  tests  next 
month. 

Further,  the  ability  of  HCFA's  computers  to  communicate  with 
non-Federal  computers  is  a  very  serious  concern.  HCFA  commu- 
nicates with  hospitals,  physicians,  State  governments,  and  its  own 
contractors  on  a  daily  basis,  and  if  problems  arise  in  these  non- 
Federal  systems,  the  communication  efforts  of  HCFA  will  be  ad- 
versely impacted. 

Another  area  of  concern  is  the  area  of  medical  equipment.  It 
bears  mentioning  that  the  Food  and  Drug  Administration  has  a 
number  of  Y2K  concerns  relating  to  medical  equipment,  and  as  of 
January  12th,  only  1,438  of  the  1,932  targeted  manufacturers  had 
submitted  Y2K  data  on  their  biomedical  equipment  to  the  Federal 
Y2K  Biomedical  Equipment  Clearinghouse. 

What  this  means  to  the  American  people  is  that  there  are  still 
a  number  of  products  about  which  there  is  not  sufficient  informa- 
tion to  know  its  Y2K  status.  A  further  concern  is  the  fact  that  the 
majority  of  manufacturers  are  not  affirmatively  notifying  users 
that  potential  problems  may  exist  in  their  equipment. 

One  solution  will  be  to  require  the  manufacturers  to  notify  the 
device  users,  including  hospitals  and  nursing  homes,  of  other  po- 
tential Y2K  problems.  Still  further,  there  is  concern  that  many  con- 
sumers may  attempt  to  hoard  prescription  drugs  at  the  turn  of  the 
century,  and  given  the  brief  shelf  life  of  some  prescription  medica- 
tions, the  FDA  must  create  contingency  plans  for  potential  drug 
shortages. 

Before  we  move  into  January  2000,  it  will  certainly  be  necessary 
to  find  a  solution  to  the  problem  of  shortages  of  prescription  drugs. 
One  of  HHS's  largest  problems  is  the  readiness  of  State  govern- 
ments which  administer  the  various  HHS  programs.  As  you  know, 
States  administer  Federal  benefits  pursuant  to  Medicare,  child 
care,  food  stamps,  and  other  government  programs.  The  recipients 
of  these  benefits  are  often  the  elderly  or  the  disabled  who  will  have 
limited  financial  resources  or  single  mothers  struggling  to  make 
ends  meet. 

That  is  why  I  know  that  HHS  will  take  the  issues  of  State  readi- 
ness very  seriously,  and  I  am  encouraged  to  hear  that  HCFA  is 
taking  steps  to  identify  and  work  with  those  States  that  have  been 
identified  as  being  the  furthest  behind.  State  readiness  for  Y2K  is 
a  critical  concern  and  one  that  HCFA  should  be  following  closely. 

Also  appearing  most  susceptible  to  disruptions  are  the  inner  city 
municipal  hospitals  and  the  rural  health  care  providers.  Given 
their  geographic  locations,  rural  providers  often  do  not  have  the  re- 
sources of  larger  institutions,  and  I  am  particularly  interested  in 
hearing  what  HCFA  is  doing  to  ensure  that  the  Y2K  concerns  of 
our  rural  health  care  providers  are  being  adequately  addressed. 

I  come  from  a  rural  district,  and  I  know  that  rural  hospitals  and 
rural  health  care  providers  need  to  be  confident  that  HCFA  will  re- 
imburse them  for  their  services  in  a  timely  manner.  HCFA  has  as- 
sured us  if  a  claim  gets  into  the  processing  system,  it  will  get  paid. 
However,  Medicare  claims  are  submitted  to  HCFA  contractors  ei- 
ther through  independent  billing  agents  or  directly  by  providers.  A 
claim  is  only  considered  in  HCFA's  system  once  it  is  received  by 
the  contractor,  and  I  would  like  to  hear  more  today  about  how  we 
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can  ensure  that  these  billing  agents  and  these  independent  provid- 
ers, such  as  rural  hospitals,  will  be  compliant  so  that  the  providers 
can  be  certain  that  they  will  be  paid. 

I  realize  there  is  much  in  the  system  that  is  out  of  the  direct  con- 
trol of  HCFA,  but  I  think  it  is  HCFA's  responsibility  to  be  sure  that 
those  independent  contractors  are  adequately  preparing  for  Y2K. 

Mr.  Chairman,  thank  you  again  for  having  this  hearing.  This  is 
probably  one  of  the  most  critical  hearings  that  we  have  had  and 
with  an  agency  that  you  and  I  both  know  has  probably  had  more 
problems  than  most  of  the  agencies  that  we  have  had  before  this 
committee. 

Mr.  Horn.  I  thank  the  gentleman  from  Texas  and  since  I  grew 
up  in  rural  America  on  a  farm,  I  share  your  views.  Thank  you. 

Now,  Mr.  Willemssen.  I  think  all  of  the  members  of  the  commit- 
tee know  this  gentleman.  He  has  done  a  splendid  job  in  his  role 
with  his  team  over  at  the  General  Accounting  Office  as  Director  of 
Civil  Agencies  Information  Systems,  and  when  we  have  held  hear- 
ings throughout  the  country,  Mr.  Willemssen  has  been  there  with 
the  opening  statement  and  we  welcome  you  today. 

STATEMENT  OF  JOEL  C.  WILLEMSSEN,  DIRECTOR,  CIVIL 
AGENCIES  INFORMATION  SYSTEMS,  GENERAL  ACCOUNTING 
OFFICE 

Mr.  Willemssen.  Thank  you,  Mr.  Chairman.  I  will  briefly  sum- 
marize the  readiness  of  HHS  to  address  the  Y2K  issue,  and  in  par- 
ticular focus  on  HCFA  and  Medicare,  and  then  on  the  Payment 
Management  System. 

First  regarding  HCFA  and  Medicare  Y2K,  we  originally  reported 
our  concerns  with  this  nearly  2  years  ago  and  at  that  time  the  level 
of  HCFA  management  attention  on  Y2K  was  minimal.  Instead 
much  of  the  agency's  system  focus  was  on  a  failed  effort  known  as 
the  Medicare  Transaction  System  which  was  intended  to  replace 
existing  part  A  and  part  B  core  computing  systems. 

As  we  have  previously  testified,  this  effort  was  terminated  after 
about  $80  million  was  spent  and  not  one  line  of  software  had  been 
delivered.  It  is  important  to  keep  that  history  in  mind  as  we  now 
look  at  the  large  challenge  that  HCFA  faces  in  addressing  Y2K. 

We  reported  last  fall  that  with  its  very  late  start  on  Y2K,  HCFA 
faced  the  prospect  of  having  too  much  to  do  in  too  little  time.  Many 
of  the  basic  Y2K  management  practices  that  we  would  have  ex- 
pected to  have  seen  were  not  there.  Our  conclusions  and  rec- 
ommendations to  the  Administrator  reflected  our  concern  about  the 
high  level  of  risk  facing  HCFA.  HCFA  has  been  responsive  to  our 
recommendations  and  the  Administrator  is  to  be  commended  for 
making  Y2K  the  agency's  top  priority  and  directing  a  number  of  ac- 
tions to  more  effectively  direct  the  project.  Among  these  many  ac- 
tions has  been  an  important  commitment  to  business  continuity 
and  contingency  planning  to  ensure  that  in  the  event  of  system 
failures,  beneficiaries  will  still  receive  care  and  providers  will  be 
paid.  Despite  its  progress,  we  still  have  serious  concerns  with 
where  HCFA  is  with  Medicare  and  Y2K. 

First,  HCFA's  reported  external  systems  progress  on  Y2K  is 
highly  overstated.  HCFA  and  HHS  recently  reported  that  54  con- 
tractor systems  were  compliant  as  of  December  31st.  In  fact  none 
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of  these  54  should  have  been  considered  compliant.  All  had  impor- 
tant exceptions,  some  of  them  very  significant. 

According  to  HCFA  officials  they  reported  these  systems  as  com- 
pliant because  the  qualifications  were  minor  problems  that  should 
not  take  much  time  to  address.  This  is  at  variance  with  the  report 
of  HCFA's  independent  verification  and  validation  contractor  on 
about  February  16th.  At  that  time  the  contractor  found  the  quali- 
fications to  be  critical,  most  requiring  a  major  to  moderate  level  of 
effort  to  resolve. 

Among  the  other  issues  that  HCFA  needs  to  address:  One,  HCFA 
still  lacks  an  integrated  schedule  that  lays  out  a  critical  path  for 
the  most  important  tasks  that  have  to  be  done. 

Two,  HCFA  has  thousands  of  data  exchanges  that  remain  to  be 
remediated  and  tested. 

Three,  HCFA  faces  a  tremendous  amount  of  testing  for  the  re- 
mainder of  this  year,  testing  both  at  a  system  level,  for  changes  to 
resolve  the  existing  qualifications,  as  well  as  other  legislatively 
mandated  changes  that  will  go  into  effect.  All  of  that  testing  will 
ultimately  determine  whether  HCFA's  systems  are  indeed  compli- 
ant. Given  the  magnitude  of  the  challenge  that  HCFA  faces,  it  is 
absolutely  critical  that  the  Administrator  sustain  her  commitment 
to  complete  and  test  business  continuity  and  contingency  plans  so 
that  if  system  failures  occur,  HCFA  will  be  positioned  with  backup 
plans. 

Next,  let  me  turn  briefly  to  HHS's  Payment  Management  System 
and  the  Program  Support  Center.  As  noted,  a  key  activity  for  this 
center  is  providing  grant  payments  totaling  over  $165  billion  annu- 
ally to  about  20,000  recipient  organizations.  The  payment  manage- 
ment system  is  instrumental  to  making  sure  those  payments  are 
made.  However,  the  system  is  not  yet  Y2K  compliant  and  it  is  un- 
clear at  this  point  when  it  will  be.  In  1995  there  was  an  effort 
begun  to  replace  the  existing  system  with  a  new  state-of-the-art 
system  that  was  expected  to  be  Y2K  compliant  and  operational  by 
October  1997.  However,  since  its  inception,  that  planned  system  re- 
placement has  encountered  problems  and  as  a  result  is  still  not 
operational.  We  understand  that  the  Program  Support  Center  has 
contracted  with  a  company  to  conduct  an  analysis  of  whether  to 
rely  on  the  replacement  system  as  the  year  2000  solution  or  rely 
on  their  existing  system  and  remediate  and  test  that.  Regardless 
of  the  outcome  of  that  analysis,  and  I  believe  that  HHS  may  be 
providing  the  results  today,  there  will  be  a  tremendous  amount  of 
work  remaining  to  make  sure,  whether  the  existing  system  or  re- 
placement system  is  the  solution,  that  is  indeed  Y2K  compliant. 
That  concludes  a  summary  of  my  statement.  I  would  be  pleased  to 
address  any  questions  that  you  have. 

[The  prepared  statement  of  Mr.  Willemssen  follows:] 
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Mr.  Chairman  and  Members  of  the  Subcommittee: 

We  appreciate  the  opportunity  to  participate  in  today's  hearing  focusing  on  the  readiness  of 
the  computer  systems  of  the  Department  of  Health  and  Human  Services  (HHS)  overall  and 
of  some  of  its  component  organizations  to  function  reliably  into  the  next  century.  HHS  is  a 
vast  department;  its  components  face  varying  challenges  in  making  sure  that  its  programs  do 
not  suffer  interruption  in  the  delivery  of  benefits  and  services  upon  which  millions  of 
Americans  depend. 

I  would  like  to  begin  today  by  summarizing  the  information  contained  in  HHS*  most  recent 
Year  2000  (Y2K)  quarterly  report  to  the  Office  of  Management  and  Budget  (OMB),  reflecting 
progress  made  as  of  December  31, 1998.  I  will  then  offer  more  specific  comments  in  areas  in 
which  we  have  done  work,  including  the  Health  Care  Financing  Administration's  (HCFA) 
Medicare  and  Medicaid  programs,  the  Administration  for  Children  and  Families'  (ACF)  state 
human  services  programs,  the  Program  Support  Center's  (PSC)  Payment  Management 
System  (PMS),  and  the  biomedical  equipment  efforts  of  the  Food  and  Drug  Administration 
(FDA). 


1 


9 


REPORTED  COMPLIANCE  STATUS  OF  HHS  SYSTEMS 

As  the  following  table  illustrates,  HHS  reported  that  as  of  December  31,  1998,  83  percent  of 
its  mission-critical  systems  were  Y2K  compliant  (243  of  294).  Of  its  34  systems  remaining  to 
be  repaired,  99  percent  were  reported  to  be  renovated,  81  percent  validated,  and  77  percent 
implemented. 
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Table  1 :  Year  2000  Compliance  Status  of  HHS'  Mission-Critical  Systems.  December  31 
1998.  as  reported  to  OMB  on  February  10. 1999. 
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7 

alncludes  four  systems  that  require  additional  coordination  of  internal  and  external 
interfaces. 

includes  the  Administration  on  Aging,  Centers  for  Disease  Control  and  Prevention,  Health 
Resources  and  Services  Administration,  Indian  Health  Service,  National  Institutes  of 
Health,  Office  of  Inspector  General,  and  Substance  Abuse  and  Mental  Health  Services 
Administration. 


Source:  Department  of  Health  and  Human  Services'  quarterly  report  to  OMB,  February  10, 
1999. 


11 


In  addition  to  the  work  that  remains  to  correct  its  mission-critical  systems,  HHS  has  much 
work  left  in  the  embedded  systems,  facilities,  and  telecommunications  areas.  Specifically, 
according  to  its  February  10, 1999,  report  to  OMB,  HHS  had  (1)  assessed  about  40  percent 
of  its  embedded  systems  (primarily  biomedical  equipment)  and  (2)  assessed  20  percent  of  its 
facilities.  Further,  HHS  reported  that  it  had  two  operating  divisions  with  compliant 
telecommunications  systems  as  well  as  others  in  varying  stages  of  assessing  and/or 
remediating  their  telecommunications  systems. 

MUCH  WORK  REMAINS  TO  ACHIEVE  COMPLIANCE  AT  HCFA 

In  a  report  issued  last  year,  we  concluded  that  the  progress  made  by  HCFA — and  its 
contractors — in  making  its  computers  that  process  Medicare  claims  Year  2000  compliant 
was  severely  behind  schedule  in  areas  including  repair,  testing,  and  implementation! 
Further,  we  made  numerous  recommendations  to  improve  key  HCFA  management  practices 
that  we  found  to  be  lacking  or  inadequate.  Today  I  would  like  to  briefly  discuss  our  findings 
from  that  report  and  our  suggestions  for  strengthening  HCFA's  Y2K  activities,  describe 


'Medicare  Computer  Systems:  Year  2000  Challenges  Put  Benefits  and  Services  in  Jeopardy 


(GAO/AIMD-98-284,  September  28, 1998). 
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actions  taken  on  those  recommendations,  and  provide  our  perspective  on  where  Medicare 
claims  processing  stands  today.  I  will  also  provide  an  update  on  the  status  of  state  systems 
that  support  HCFA's  Medicaid  program. 

Medicare  Systems  Remain  At  High  Risk 

As  the  nation's  largest  health  care  insurer,  Medicare  expects  to  process  over  a  billion  claims 
and  pay  $288  billion  in  benefits  annually  by  2000.  The  consequences,  then,  of  its  systems' 
not  being  Year  2000  compliant  could  be  enormous.  We  originally  highlighted  this  concern  in 
May  1997,  making  several  recommendations  for  improvement.2  In  our  report  of  last 
September  we  warned  that  although  HCFA  had  made  improvements  in  its  Year  2000 
management,  serious  challenges  remained  to  be  resolved  in  a  short  period  of  time. 
Specifically,  we  reported  that  less  than  a  third  of  Medicare's  mission-critical  systems  had 
been  fully  renovated,  and  none  had  been  validated  or  implemented.  Further,  in  terms  of  the 
agency's  key  management  practices  necessary  to  adequately  direct  and  monitor  its  Year 
2000  project,  HCFA  had  not 


'Medicare  Transaction  System:  Success  Depends  Upon  Correcting  Critical  Managerial  and 
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■  developed  an  overall  schedule  or  critical  path  to  identify  and  rank  Y2K  tasks  to  help 
ensure  that  they  could  be  completed  in  a  timely  manner, 

■  implemented  risk  management  processes  necessary  to  highlight  potential  technical 
and  managerial  weaknesses  that  could  impair  project  success; 

■  planned  for  or  scheduled  end-to-end  testing  to  ensure  that  program-wide  renovations 
would  work  as  planned;  or 

■  effectively  managed  its  electronic  data  exchanges,  thereby  increasing  the  risk  that 
Y2K  errors  would  be  transferred  through  data  exchanges  from  one  organization's 
computer  systems  to  those  of  another. 

OMB  also  had  concerns.  In  its  December  8, 1998,  summary  of  Year  2000  progress  reports  of 
all  agencies  for  the  reporting  quarter  ending  November  13, 1998,  it  concluded  that  while 
HCFA  had  made  significant  progress  in  renovating  its  internal  and  external  systems,  the 
agency  remained  a  serious  concern  due  to  the  remediation  schedule  of  its  external  systems. 
OMB  further  stated  that  Medicare  contractors  would  have  to  make  an  intensive,  sustained 
effort  to  complete  validation  and  implementation  of  their  mission-critical  systems  by  the 
governmentwide  goal  of  March  31,  1999.  OMB  designated  HHS  as  a  tier  1  agency  on  its 
three-tiered  rating  scale  since  it  had  made  insufficient  progress  in  addressing  the  Year  2000 
problem. 
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Our  conclusions  and  recommendations  to  the  HCFA  Administrator  reflected  our  concerns 
about  the  high  level  of  risk  and  large  number  of  tasks  still  facing  HCFA.  We  reported  that  it 
was  more  critical  than  ever  that  HCFA  have  sound  business  continuity  and  contingency 
plans  in  place  that  could  be  implemented  should  systems  failures  occur.  Our  specific 
recommendations  included  that  HCFA 

■  rank  its  remaining  Year  2000  work  on  the  basis  of  an  integrated  project  schedule  and 
ensure  that  all  critical  tasks  are  prioritized  and  completed  in  time  to  prevent 
unnecessary  delays, 

■  develop  a  risk  management  process, 

■  define  the  scope  of  an  end-to-end  test  of  the  claims  process  and  develop  plans  and  a 
schedule  for  conducting  such  a  test, 

■  ensure  that  all  external  and  internal  systems'  data  exchanges  have  been  identified 
and  agreements  signed  among  exchange  partners,  and 

■  accelerate  the  development  of  business  continuity  and  contingency  plans. 

HCFA's  Actions  to  Achieve  Compliance  in  its  Medicare  Systems 

HCFA  has  been  responsive  to  our  recommendations,  and  its  top  management  is  actively 
engaged  in  its  Year  2000  program.  HCFA's  Administrator  has  made  Year  2000  compliance 
the  agency's  top  priority  and  has  directed  a  number  of  actions  to  more  effectively  manage 
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this  project  For  example,  HCFA  has  established  a  "war  room"  for  real-time  monitoring  of 
Year  2000  renovation,  testing,  and  implementation  activities.  In  addition,  the  agency 
established  seven  contractor  oversight  teams  to  monitor  progress.  HCFA  also  strengthened 
its  outreach  efforts:  on  January  12,  1999,  the  Administrator  sent  individual  letters  to  each  of 
the  1.25  million  Medicare  providers  in  the  United  States,  alerting  them  to  take  prompt  Year 
2000  action  on  their  information  and  billing  systems.  Three  days  later  the  Administrator 
sent  a  letter  to  Congress,  with  assurances  that  HCFA  is  making  progress  and  stressing  that 
physicians,  hospitals,  and  other  providers  must  also  meet  the  Y2K  challenge.  HCFA  also 
offered  to  provide  speakers  in  local  congressional  districts. 

To  more  effectively  identify  and  manage  risks,  HCFA  is  relying  on  multiple  sources  of 
information,  including  test  reports,  reports  from  its  independent  validation  and  verification 
(rV&V)  contractors,  and  weekly  status  reports  from  its  recently  established  contractor 
oversight  teams.  In  addition,  HCFA  has  stationed  staff  at  critical  contractor  sites  to  assess 
the  data  being  reported  to  them  and  to  identify  problems. 

^, 

HCFA  is  also  more  effectively  managing  its  electronic  data  exchanges.  HCFA  now  reports 
having  a  complete  data  exchange  inventory  of  nearly  8,000  internal  exchanges  and  over 
255,000  external  data  exchanges.  HCFA  also  issued  instructions  to  its  contractors  (carriers 
and  fiscal  intermediaries)  to  inform  providers  and  suppliers  that  they  must  submit  Medicare 
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claims  in  Year  2000-compliant  data  exchange  format  by  April  5  of  this  year.  The  status  of 
each  of  these  data  exchanges  is  being  tracked  by  HCFA  staff. 

HCFA  has  also  more  clearly  defined  its  testing  procedures.  It  published  additional  testing 
guidance  in  November  1998  that  provided  a  policy  for  external  systems  that  requires 
multiple  levels  of  testing  for  each  system,  including: 

■  Unit  level  testing  testing  of  the  individual  software  component  using  test  cases  that 
exercise  all  component  functionality.  For  the  standard  claims  processing  system, 
this  includes  full  functional  testing  of  claims  processing  policy  and  program  integrity 
edits. 

■  Simulated  future  date  testing  testing  of  the  individual  software  component  using 
tools  to  simulate  that  the  date  has  been  rolied  forward. 

■  Compliance  testing:  testing  in  a  fully  Year  2000-compliant  environment  with  real 
future  dates  to  verify  that  the  system  is  Year  2000  compliant. 

HCFA  also  plans  to  perform  end-to-end  testing  with  its  Year  2000-compliant  test  sites.  These 
end-to-end  tests  are  to  include  all  internal  systems  and  contractor  systems;  however,  they 
will  not  include  testing  with  banks  and  providers.  Finally,  HCFA  has  begun  to  use  a  Year 
2000  analysis  tool  to  measure  testing  thoroughness,  and  its  IV&V  contractor  is  assessing  test 
adequacy  on  the  external  systems  (e.g.,  test  coverage  and  documentation). 
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The  final  area  in  which  HCFA  has  demonstrated  progress  is  developing  business  continuity 
and  contingency  plans  to  ensure  that,  no  matter  what,  beneficiaries  will  receive  care  and 
providers  will  be  paid.  HCFA  has  established  cross-organizational  workgroups  to  develop 
contingency  plans  for  the  following  core  business  functions:  health  plan  and  provider 
payment,  eligibility  and  enrollment  issues,  program  integrity,  managed  care,  quality  of  care, 
litigation,  and  telecommunications.  HCFA's  draft  plans  document  its  business  impact 
analysis;  the  contingency  plans  are  expected  to  be  completed  by  March  31  of  this  year,  and 
testing  of  the  plans  by  June  30. 

Reported  Status  of  HCFA's  Mission-Critical  Systems 

HCFA  operates  and  maintains  25  internal  mission-critical  systems.  HCFA  also  has  78 
external  mission-critical  systems'  operated  by  contractors  throughout  the  country  to 
process  Medicare  claims.  These  external  systems  include  six  standard  processing  systems 
and  the  "Common  Working  File."  Each  contractor  relies  on  one  of  these  standard  systems 


*HHS  reported  82  HCFA  external  mission-critical  systems,  however,  4  of  these  are  due  to  be 
retired. 
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to  process  its  claims,  and  adds  its  own  front-end  and  back-end  processing  systems.  The 
Common  Working  File  is  a  set  of  databases  located  at  nine  sites  that  works  with  internal  and 
external  systems  to  authorize  claims  payments  and  determine  beneficiary  eligibility. 

HCFA's  reporting  of  its  readiness  for  next  January  sounds  quite  positive  as  stated  in  the 
most  recent  HHS  Y2K  quarterly  progress  report  to  OMB.  According  to  this  report,  dated 
February  10,  as  of  December  31, 1998,  all  25  of  HCFA's  internal  mission-critical  systems 
were  reported  to  be  compliant,  as  were  54  of  the  78  external  systems.  Figure  1  shows 
HCFA's  reported  status,  compared  with  what  it  reported  on  September  30, 1998. 
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Figure  1:  Reported  Status  of  HCFA's  Mission-Critical  Systems 


Source:  HCFA  quarterly  reports  to  HHS. 
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Reported  Progress  Is  Highly  Overstated 

HCFA's  reported  progress  on  its  external  mission-critical  systems  is  considerably 
overstated.  In  fact,  none  of  the  54  systems  reported  compliant  by  HCFA  was  Year  2000 
ready  as  of  December  31, 1998.  All  54  external  systems  that  were  reported  as  compliant  had 
important  associated  qualifications  (exceptions),  some  of  them  very  significant.  Such 
qualifications  included  a  major  standard  system  that  failed  to  recognize  "00"  as  a  valid  year, 
as  well  as  2000  as  a  leap  year;  it  also  included  systems  that  were  not  fully  future-date  tested. 

According  to  HCFA  officials,  they  reported  these  systems  as  compliant  because  these 
qualifications  were  "minor  problems"  that  should  not  take  much  time  to  address.  This  is  at 
variance  with  the  IV&V  contractor's  interpretation.  More  specifically,  the  IV&V  contractor 
found  that  the  qualifications  reported  by  all  systems  contractors  were  critical,  most 
requiring  a  major  to  moderate  level  of  effort  to  resolve. 

A  specific  example  of  a  system  reported  as  compliant  with  qualifications  is  the  Florida 
standard  system,  used  by  29  contractors.  This  system  had  one  qualification  that  consisted 
of  22  test  failures.  The  IV&V  contractor  characterized  this  failure  experience  as  significant. 
HCFA  reports  that  these  failures  were  corrected  with  a  January  29, 1999,  software  release. 
However,  in  a  February  16,  1999,  IV&V  status  report,  Blue  Cross  of  California— a  user  of  the 
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Florida  standard  system-found  that  date  test  problems  remained.  In  another  example,  the 
EDS  MCS  standard  system  that  is  used  by  10  contractors  had  25  qualifications;  these 
included  9  problems  that  were  not  future-date  tested.  HCFA  now  reports  that  future-date 
testing  of  the  January  software  release  of  the  EDS  MCS  system  is  92  percent  complete. 

As  these  examples  illustrate,  the  systems  are  not  yet  Year  2000  compliant,  and  the  39 
contractors  that  use  these  two  standard  systems  likewise  cannot  be  considered  compliant. 
Further,  according  to  the  IV&V  contractor,  two  critical  qualifications  associated  with  each  of 
the  standard  systems  affect  all  external  contractor  systems:  (1)  HCFA-supplied  systems  that 
contractors  use  in  claims  processing  were  delivered  to  them  too  late  for  required  testing  to 
be  performed;  and  (2)  the  claims  processing  data  centers'  hardware,  software,  and 
telecommunications  were  not  completely  compliant. 

The  IV&V  contractor  acknowledges  that  Medicare  claims  processing  systems  have  made 
progress  toward  Year  2000  compliance  over  the  past  year,  yet  the  various  qualifications 
inevitably  mean  that  some  renovation  and  a  significant  amount  of  retesting  still  needs  to  be 
accomplished  before  these  systems  can  be  considered  compliant.  To  HCFA's  credit,  it 
issued  a  memorandum  in  early  January  requesting  Medicare  carriers  and  fiscal 
intermediaries  to  resolve  these  qualifications  by  March  31,  the  federal  target  date  for  Year 
2000  compliance.  The  notice  stated  that  Medicare  systems  with  unresolved  Y2K  problems 
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affecting  claims  processing  functions  must  be  corrected,  tested,  and  installed  in  production. 
As  part  of  our  ongoing  work  for  the  Senate  Special  Committee  on  Aging,  we  will  be 
monitoring  the  resolution  of  these  qualifications  closely. 

Other  Critical  Risks/Challenges  That  Remain 

The  February  16, 1999,  report  of  HCFA's  IV&V  contractor  stated  that  an  integrated  schedule 
that  tracks  all  major  internal  systems  activities  needs  to  be  established.  It  added  that 
system-specific  information-including  time,  test  scheduling,  and  resource  considerations- 
needs  to  be  more  fully  developed  in  order  to  achieve  a  robust,  trackable  schedule.  We 
agree.  In  fact,  this  is  consistent  with  our  previous  recommendation  that  remaining  Y2K 
work  be  ranked  on  the  basis  of  a  schedule  that  includes  milestones  for  renovation  and 
testing  of  all  systems,  and  that  it  include  time  for  end-to-end  testing  and  development  and 
testing  of  business  continuity  and  contingency  plans."  Such  a  schedule  is  even  more 
important  for  the  external  systems  because  of  their  greater  number,  complexity,  and 
interdependencies.  HCFA  still  lacks  an  integrated  schedule  that  identifies  a  critical  path. 


4GAO/AIMD-98-284,  September  28, 1998. 
15 


23 


Without  this,  it  will  be  difficult  for  HCFA  management  to  identify  important  dependencies  in 
this  complex  environment  and  to  prioritize  its  remaining  work  in  the  time  that  remains. 
HCFA  also  lacks  a  formal  risk  management  process — something  to  identify  all  risks  and 
their  interdependencies,  assess  their  impact,  establish  time  frames  for  mitigation  and 
criteria  for  successful  mitigation,  and  ensure  that  the  criteria  are  followed.  The  one  system 
that  was  intended  to  serve  as  its  comprehensive  risk  management  system  does  not  contain 
current  information,  according  to  the  FV&V  contractor. 

HCFA's  systems — both  internal  and  external — exchange  data,  both  among  themselves  and 
with  the  Common  Working  File,  other  federal  agencies,  banks,  and  providers.  Accordingly, 
it  is  important  that  HCFA  ensure  that  Y2K-related  errors  will  not  be  introduced  into  the 
Medicare  program  through  these  data  exchanges.  As  of  February  10, 1999,  HCFA  reported 
that  over  6,000  of  its  7,968  internal  data  exchanges  were  still  not  compliant,  and  that  over 
37,000  of  its  nearly  255,000  external  data  exchanges  were  not  compliant!  To  ensure  that 
HCFA's  internal  and  external  systems  are  capable  of  exchanging  data  among  themselves  as 


8On  February  23, 1999,  the  HCFA  Administrator  stated  that  she  wanted  us  to  note  that  the 
February  10, 1999,  HHS  quarterly  report  to  OMB  had  a  typographical  error,  and  that  the  total 
number  of  internal  data  exchanges  is  3,418  and  that  309  of  these  are  still  not  compliant 
16 


24 


well  as  with  other  federal  agencies,  banks,  and  providers,  it  is  essential  that  HCFA  take 
steps  to  resolve  the  remaining  noncompliance  of  these  data  exchanges. 

In  yet  another  critical  area,  HCFA  faces  a  significant  amount  of  testing  in  1999,  since 
changes  will  continue  to  be  made  to  its  mission-critical  systems  to  make  them  compliant. 
First,  changes  to  resolve  the  existing  qualifications  will  need  to  be  retested.  Second,  testing 
must  still  take  place  with  full  production-level  software.  For  example,  the  final  software 
release  of  the  Common  Working  File  before  2000  is  scheduled  for  late  June;  testing  will 
therefore  be  needed  after  that.  Third,  legislatively  mandated  changes  to  software  that  will 
occur  through  June  will  need  to  be  retested  as  well.  HCFA  plans  to  conduct  these  final  tests 
of  its  systems  between  July  1  and  November  1, 1999,  then  recertify  all  mission-critical 
systems  as  compliant  without  qualification  or  exception.  These  final  tests  will  ultimately 
determine  whether  HCFA's  mission-critical  systems  are  indeed  Year  2000  compliant  The 
late  1999  time  frames  associated  with  this  testing  represent  a  high  degree  of  risk. 

In  addition  to  such  individual  systems  testing,  HCFA  must  also  test  its  systems  end-to-end  to 
verify  that  defined  sets  of  interrelated  systems,  which  collectively  support  an  organizational 
core  business  function,  will  work  as  intended.  As  mentioned,  HCFA  plans  to  perform  this 
end-to-end  testing  with  its  Year  2000  test  sites.  These  tests  are  to  include  all  internal 
systems  and  contractor  systems,  but  will  not  include  testing  with  banks  and  providers. 
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HCFA  has  instructed  its  contractors  that  it  is  their  responsibility  to  test  with  providers  and 
financial  institutions.  Even  excluding  banks  and  providers,  end-to-end  testing  of  HCFA's 
internal  and  external  systems  is  a  massive  undertaking  that  will  need  to  be  effectively 
planned  arid  earned  out  HCFA  has  not  yet,  however,  developed  a  detailed  end-to-end  test 
plan  that  explains  how  these  tests  will  be  conducted  or  that  provides  a  detailed  schedule  for 
conducting  them. 

A  final  aspect  of  testing  concerns  the  independent  testing  contractor.  The  IY&V  contractor's 
recent  assessment  of  the  independent  testing  contractor  concluded  that  its  strategy  as 
currently  stated  "is  high  risk  for  providing  effective  independent  testing"  because  of  the 
limited  number  of  internal  systems  to  actually  be  independently  tested:  8.  This  number  was 
previously  22.  Further,  this  testing  will  not  be  completed  until  August,  The  limited  number 
of  systems  tested  and  the  late  completion  date  are  not  reassuring. 

Given  the  magnitude  of  HCFA's  Year  2000  problem  and  the  many  challenges  that  continue  to 
face  it  the  development  of  contingency  plans  to  ensure  continuity  of  critical  operations  and 
business  processes  is  absolutely  critical.  Therefore,  HCFA  must  sustain  its  efforts  to 
complete  and  test  its  agency-wide  business  continuity  and  contingency  plans  by  June  30. 
Another  challenge  for  HCFA  is  monitoring  the  progress  of  the  62  separate  business 
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continuity  and  contingency  plans  that  will  be  submitted  by  its  contractors.  We  will  continue 
to  monitor  progress  in  this  area. 

Other  issues  that  further  complicate  HCFA's  Year  2000  challenge  are  the  known  and 
unknown  contractor  transitions  that  are  to  take  place  before  January  1,  2000,  and  the 
unknown  status  of  the  managed  care  organizations  serving  Medicare  beneficiaries.  As 
reported  in  HHS'  quarterly  submission  to  OMB,  HCFA  is  concerned  about  the  possibility  of 
Medicare  contractors,  fiscal  intermediaries,  and  carriers  leaving  the  program  and  notifying 
HCFA  after  June  1999.  If  this  were  to  occur,  the  workload  would  have  to  be  transferred  to 
another  contractor  whose  Year  2000  compliance  status  may  not  be  known.  According  to 
both  contractor  and  HCFA  officials,  it  requires  6-12  months  to  transfer  the  claims  processing 
workload  from  one  contractor  to  another.  At  present,  HCFA  must  transition  the  work  of 
three  carriers  that  are  leaving  the  program. 

HCFA  is  requiring  the  386  managed  care  organizations  currently  serving  6.6  million 
Medicare  beneficiaries  to  certify  their  systems  as  Year  2000  compliant  by  this  April  15. 
These  certifications  may  be  qualified,  just  as  with  the  fee-for-service  contractors.  If  this 
were  to  occur,  a  formal  recertification  would  have  to  be  performed  later  this  year.  Until  this 
initial  certification  is  performed,  it  will  remain  unknown  whether  the  managed  care 
organizations'  systems  are  Year  2000  compliant 
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To  summarize  HCFA's  Medicare  situation,  the  agency  and  its  contractors  have  made 
progress  in  addressing  issues  that  we  have  raised.  However,  their  reported  progress  vastly 
overstates  the  facts.  Some  renovation  and  a  significant  amount  of  testing  must  still  be 
performed  this  year.  Until  HCFA  completes  its  planned  recertification  between  July  and 
November  1999,  the  final  status  of  the  agency's  Year  2000  compliance  will  be  unknown. 
Given  the  considerable  amount  of  remaining  work  that  HCFA  faces,  it  is  crucial  that 
development  and  testing  of  HCFA's  business  continuity  and  contingency  plans  move 
forward  rapidly  if  we  are  to  avoid  interruption  of  Medicare  claims  processing  next  year. 

Medicaid  Systems  Are  At  Risk 

In  fiscal  year  1997,  Medicaid-a  joint  federal-state  program  supported  by  HCFA  and 
administered  by  the  states-provided  about  $160  billion  to  millions  of  recipients.  Medicaid 
provides  health  coverage  for  36  million  low-income  people,  including  over  17  million 
children.  Its  beneficiaries  also  include  elderly,  blind,  and  disabled  individuals. 
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In  surveying  states'  Year  2000  status  last  summer,6  we  found  that  many  systems  were  at  risk 
and  much  work  remained  to  ensure  the  continuation  of  services.  The  states'  reported 
compliance  rate  for  Medicaid  systems  was  only  about  16  percent,  and  18  states  reported  that 
they  had  completed  renovating  one  quarter  or  fewer  of  their  Medicaid  claims  processing 
systems.  These  18  states  had  Medicaid  expenditures  of  about  $40  billion  in  fiscal  year  1997- 
one-quarter  of  total  Medicaid  expenditures  nationwide,  covering  about  9.5  million 
recipients. 

Since  last  summer,  HCFA  has  administered  two  state  self-reporting  surveys  and  conducted 
several  on-site  visits,  finding  that  overall  state  Medicaid  systems  status  has  improved  little. 
For  example,  HCFA  reported  in  November  1998  that  Medicaid  systems  had  shown  some 
progress  in  renovation,  but  that  the  number  of  states  reporting  completion  of  this  phase  had 
actually  decreased  compared  with  the  July/August  1998  data  that  were  reported  to  us  by  the 
states.  It  found,  further,  that  1 1  states'  Medicaid  systems  were  still  reported  to  be  25  percent 
or  less  renovated,  and  about  half  of  the  states  were  50  percent  or  less  renovated.  Only  five 


'Year  2000  Computing  Crisis:  Readiness  of  State  Automated  Systems  to  Support  Federal 
Welfare  Programs  (GAO/AIMD-99-28,  November  6, 1998).  We  sent  a  survey  to  the  50  states, 
the  District  of  Columbia,  and  three  territories  (Guam,  Puerto  Rico,  and  the  Virgin  Islands). 
All  but  one  of  the  54  entities  surveyed  responded. 
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states — Arkansas,  California,  Idaho,  Illinois,  and  Iowa — reported  their  Medicaid  systems  to 
be  100  percent  renovated.  Thus,  while  OMB  guidelines  target  completion  of  systems 
renovation  by  September  1998,  states'  self  reported  data  to  HCFA  showed  that  about  90 
percent  of  states  had  not  completed  renovation  for  the  Medicaid  programs  as  of  November 
1998. 

To  obtain  more  reliable  Year  2000  state  Medicaid  status  information,  HCFA  hired  a 
contractor  to  conduct  independent  verification  and  validation  of  states'  systems.  As  an 
initial  effort,  the  contractor  and  HCFA  distributed  a  survey  to  all  states  to  ascertain 
background  and  Year  2000  status  information.  However,  based  on  more  recent  information 
from  on-site  visits,  the  FV&V  project  leader  said  that  the  survey  data  were  not  as  reliable  as 
HCFA  had  expected  because  states  tended  to  overstate  their  progress.  As  a  result,  HCFA 
has  instead  decided  to  rely  on  on-site  contractor  visits  to  ascertain  accurate  Medicaid 
systems  status. 

HCFA  reported  in  HHS'  February  1999  quarterly  report  to  OMB  that  based  on  seven  site 
visits,  some  of  the  dates  that  states  had  reported  to  us  last  July/August  had  slipped, 
underscoring  the  need  for  on-site  visits  to  secure  more  accurate  information.  For  example, 
according  to  HCFA,  while  four  states  appeared  to  have  made  some  progress  in  the  6  months 
since  our  survey,  the  status  of  three  states  remained  the  same.  Further,  HCFA  found  that 
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one  state's  Medicaid  eligibility  system  was  not  as  far  along  as  the  state  had  reported.  As  of 
February  17,  1999,  HCFA  told  us  that  it  had  visited  14  states  and  that  half  of  those  states  had 
shown  some  improvement.  Thus,  HCFA  and  the  IV&V  contractor  plan  to  make  on-site  visits 
to  all  50  states  and  the  District  of  Columbia  by  the  end  of  this  April.  For  states  considered  at 
risk,  HCFA  will  conduct  second  site  visits  between  May  and  September  1999  and,  if 
necessary,  third  visits  between  October  and  December.  The  later  visits  will  emphasize 
contingency  planning  to  help  the  states  ensure  continuity  of  program  operations  in  the  event 
of  systems  failures. 


CURRENT  STATUS  OF  STATE  SYSTEMS  SUPPORTING  ACF  PROGRAMS  IS  UNKNOWN 

Key  state-administered  programs  that  could  be  affected  by  Y2K  include  Temporary 
Assistance  for  Needy  Families  (TANF),  Child  Support  Enforcement  (CSE),  Child  Care  (CC), 
and  Child  Welfare  (CW)  programs;  these  programs-critical  to  the  health  and  well  being  of 
the  needy — are  overseen  by  HHS'  ACF.  These  programs  focus  on  providing  benefits  to 
economically  needy  families  with  children  who  lack  financial  support  from  one  or  both 
parents  because  of  death,  absence,  incapacity,  or  unemployment.  In  fiscal  year  1997,  federal 
and  state  agencies  spent  just  under  $14  billion  on  cash  and  work-based  assistance.  Of  this 
total,  almost  $8  billion  was  federal  money,  while  just  over  $6  billion  was  state-funded. 
These  programs  served  almost  8  million  recipients  as  of  September  1998. 
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Failure  to  complete  Year  2000  conversion  activities  for  these  programs  could  cause  billions 
of  dollars  in  benefits  payments  to  fail  to  reach  our  nation's  needy  families.  Those  newly 
approved  for  benefits  could  face  an  inability  to  be  automatically  added  to  the  recipient  file; 
eligibility  for  new  applicants  might  not  be  able  to  be  determined  in  a  timely  fashion;  eligible 
recipients  could  be  denied  benefits,  and  payments  could  be  underpaid,  overpaid,  or  delayed. 

As  figure  2  illustrates,  our  November  1998  report  on  the  Year  2000  readiness  of  state  systems 
that  support  these  programs  found  that,  although  progress  varied,  many  systems  were  at 
risk  and  much  work  remained  to  ensure  continuation  of  services.' 


7GAO/AIMD-99-28)  November  6, 1998. 
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Figure  2:  Percentage  of  Systems  Reported  Compliant  -  July/August  1998. 
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Following  our  report,  OMB  implemented  a  requirement  that  federal  oversight  agencies 
include  the  status  of  state  human  services  systems  in  quarterly  Year  2000  progress  reports. 
Specifically,  it  requested  that  federal  agencies  describe  actions  to  help  ensure  that  federally 
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supported,  state-run  programs  will  be  able  to  provide  services  and  benefits8  OMB  has 
further  asked  that  agencies  report  the  date  when  each  state's  systems  will  be  Year  2000 
compliant,  and  provide  information  on  any  significant  difficulties  that  states  are 
encountering. 

ACF  is  currently  surveying  the  states  to  determine  the  status  of  TANF,  child  support 
enforcement,  child  care,  and  child  welfare  systems,  however,  it  does  not  have  current 
information  on  states'  systems.  In  response  to  OMB's  requirement  to  provide  updated  state 
systems  status  in  the  quarterly  Y2K  progress  reports,  ACF  sent  letters  and  surveys  to  state 
Chief  Information  Officers  asking  for  such  information,  requesting  that  states  to  return  the 
survey  by  January  31,  1999.  As  of  February  16, 1999,  ACF  had  received  responses  from  27 
states.  Further,  according  to  HHS'  Year  2000  program  manager,  the  information  provided  by 
the  states  raised  more  questions  than  answers;  some  states  did  not  answer  all  questions  or 
complete  the  survey  for  all  systems. 


8OMB  Memorandum  for  the  Heads  of  Selected  Agencies,  Revised  Reporting  Guidance  on 
Year  2000  Efforts,  January  26,  1999.  The  state  programs  included  were  Food  Stamps, 
Medical  Assistance,  Unemployment  Insurance,  TANF,  Child  Support  Enforcement,  WIC, 
Low  Income  Home  Energy  Assistance,  Child  Nutrition,  Child  Care,  and  Child  Welfare. 
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ACF  is  now  proposing  on-site  reviews  of  state  systems  for  TANF  and  the  child  support 
enforcement,  child  welfare,  and  child  care  programs  in  all  50  states.  ACF  sees  these  reviews 
as  enhancing  the  available  information  concerning  states'  Year  2000  readiness  and  providing 
a  vehicle  through  which  the  agency  can  provide  states  with  technical  assistance.  ACF  is 
considering  developing  a  process  similar  to  the  one  being  used  by  HCFA,  or  possibly 
working  with  HCFA  in  gathering  information. 

STATUS  OF  PSC's  PAYMENT  MANAGEMENT  SYSTEM 

HHS'  PSC  provides  grants  payments  and  cash  management  services  through  its  Payment 
Management  System  (PMS)  to  all  HHS  agencies  and  to  10  other  federal  agencies  on  a  fee- 
for-service  basis.  PSC  is  organized  into  three  business  units,  referred  to  as  "services".  Each 
service  is  responsible  for  a  particular  line  of  business. 

■  The  Administrative  Operations  Service's  responsibilities  include  property  management; 
distribution  of  pharmaceuticals;  medical  and  dental  supplies;  information  systems 
support;  and  technical  information  services. 

■  The  Financial  Management  Service  is  responsible  for  providing  financial  services  such 
as  grants  payments  and  cash  management. 
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■  The  Human  Resources  Service  is  responsible  for  providing  a  full  range  of  human 
resources  services  such  as  personnel  operations  and  payroll. 

A  key  PSC  activity  is  providing  electronic  funding  and  cash  management  service  to 
organizations  receiving  HHS  grants  and  contracts,  as  well  as  grants  from  other  federal 
agencies.  Its  list  of  federal  customers  includes  the  Departments  of  Agriculture,  Energy, 
Interior,  Labor;  and  the  Federal  Emergency  Management  Agency,  the  Corporation  for 
National  Service,  the  National  Aeronautics  and  Space  Administration,  the  Social  Security 
Administration,  the  Agency  for  International  Development,  and  the  U.S.  Information  Agency. 
According  to  PSC,  its  customer  environment  also  includes  12  HHS  operating  divisions,  and 
about  20,000  recipient  organizations: 

■  2,900  universities  and  educational  organizations; 

■  7,500  hospitals,  health,  and  nonprofit  organizations; 

■  3,800  state  government  agencies;  and 

■  6,300  cross-servicing  recipients. 

These  recipients  receive  about  $165  billion  annually  in  federal  grants  payments  for  a  wide 
range  of  activities  such  as  school  lunch  programs,  highway  construction,  and  health  care. 


28 


36 


Delays  in  Year  2000  Readiness  of  PMS 

PSC  has  identified  eight  mission  critical  systems  spanning  the  diversity  of  its  aclministrative, 
financial,  and  human  resources  activities: 

■  Commissioned  Corps  Personnel  and  Payroll  System, 

■  Civilian  Payroll  and  Personnel  System, 

■  Automated  Payment  and  Adjustment  System, 

■  Debt  Collection  System, 

■  5ESS  Telephone  Switch, 

■  PSC  LAN  Servers, 

■  Payment  Management  System,  and  the 

■  CORE  Accounting  System. 

Of  PSC's  eight  mission-critical  systems,  the  Payment  Management  System  is  one  of  the  most 
critical.  However,  this  system  is  not  yet  compliant,  and  it  is  unclear  when  it  will  be. 
Developed  for  the  purpose  of  creating  a  central  system  for  paying  most  federal  assistance 
grants,  block  grants,  and  contracts,  the  main  purpose  of  PMS  is  to  serve  as  a  fiscal 
intermediary  between  awarding  agencies  and  the  recipients  of  grants  and  contracts.  PSC 
uses  PMS  to  process  billions  of  dollars  in  payments  to  recipient  organizations-over  half  of 
all  federal  grant  payments.  Indeed,  it  is  PMS  that  makes  available  to  states  approximately 
$96  billion  in  Medicaid  payments  annually. 
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PMS  was  originally  created  30  years  ago,  and  has  been  expanded  and  modified  several  times 
since,  according  to  PSC.  In  1995,  PSC  began  a  project  to  replace  PMS  with  a  new,  state-of- 
the-art  automated  system  known  as  the  "Reengineered  Payment  Management  System".  It 
was  anticipated  that  this  new  system  would  be  Year  2000  compliant  and  operational  by 
October  1997. 

Since  its  inception,  the  planned  system  replacement  has  encountered  problems  and,  as  a 
result,  is  still  not  operational.  For  example,  according  to  a  December  1997  PSC  status 
report  to  HHS,  the  original  contractor  for  the  replacement  system  failed  to  maintain  the 
agreed-upon  schedule  and  therefore  PSC  decided  to  hire  another  contractor  to  implement 
the  system.  With  the  new  contractor,  the  estimated  date  to  complete  the  new  system  was 
revised  to  October  1,  1998,  which  was  not  met 

Problems  appear  to  continue  to  plague  the  new  system  replacement  effort  For  example,  in 
its  biweekly  status  report  for  the  period  ending  February  12,  1999,  the  contractor  reports 
that  portions  of  the  implementation  strategy  are  in  jeopardy  due  to  problems  with  database 
extracts  from  the  existing  system.  The  contractor  is  concerned  that  database  extracts,  if 
transitioned  to  the  new  system,  "may  contain  hidden  surprises." 
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Despite  the  new  system's  problems,  the  Director  of  the  Division  of  Payment  Management 
told  us  that  he  expects  the  new  system  to  be  operational  and  Year  2000  compliant  by  March 
31,  1999.  Nevertheless,  because  PSC  was  concerned  that  it  was  at  risk  of  not  having  a  fully 
tested  compliant  system,  it  contracted  in  January  1999  for  an  independent  consulting  firm  to 
conduct  an  analysis  of  whether  PSC  should  rely  on  the  new  replacement  system  as  its  Year 
2000  solution  or,  instead,  rely  on  remediation  and  testing  of  the  existing  payment 
management  system.  According  to  the  Division  Director,  this  analysis  was  due  on  February 
23.  The  Division  Director  stated  that,  as  of  this  date,  he  had  not  received  the  final  report. 
According  to  the  firm  contracted  by  PSC,  whichever  option  PSC  pursues,  program 
management  and  independent  verification  and  validation  support  will  be  required  for  the 
successful  completion  of  the  project. 


SOME  BIOMEDICAL  EQUIPMENT  STATUS  INFORMATION  AVAILABLE  THROUGH  FDA 

The  question  of  whether  medical  devices  such  as  magnetic  resonance  imaging  (MRI) 
systems,  x-ray  machines,  pacemakers,  and  cardiac  monitoring  equipment  can  be  counted  on 
to  work  reliably  on  and  after  January  1,  2000,  is  critical  to  our  nation's  health  care.  To  the 
extent  that  biomedical  equipment  uses  embedded  computer  chips  and  software,  it  is 
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vulnerable  to  the  Y2K  problem.9  Such  vulnerability  carries  with  it  possible  safety  risks.  This 
could  range  from  the  more  benign — such  as  incorrect  formatting  of  a  printout — to  the  most 
serious — such  as  incorrect  operation  of  equipment  with  the  potential  to  decrease  patient 
safety.  The  degree  of  risk  depends  on  the  role  the  equipment  plays  in  the  patient's  care. 

Responsibility  for  oversight  and  regulation  of  medical  devices,  including  the  impact  of  the 
Y2K  problem,  lies  with  FDA.  It  provides  information  from  biomedical  equipment 
manufacturers  through  an  Internet  World  Wide  Web  site.  Last  September,10  we  reported  that 
FDA  had  a  disappointing  response  rate  from  biomedical  equipment  manufacturers  to  its 
request  for  compliance  information.  The  FDA  biomedical  equipment  database  also  lacked 
detailed  information  on  the  make  and  model  of  compliant  equipment  Further,  FDA  did  not 
require  manufacturers  to  submit  test  results  certifying  compliance.  Therefore,  the  adequacy 
of  manufacturers'  corrections  of  noncompliant  equipment  could  not  be  assured. 


biomedical  equipment  refers  both  to  medical  devices  regulated  by  FDA,  and  scientific  and 
research  instruments,  which  are  not  subject  to  FDA  regulation. 

I0Year  2000  Computing  Crisis:  Compliance  Status  of  Many  Biomedical  Equipment  Items  Still 
Unknown  (GAO/AIMD-98-240,  September  18, 1998). 


32 


40 


To  address  these  issues,  we  made  recommendations  to  the  Secretaries  of  HHS  and  Veterans 
Affairs  (VA)-a  key  stakeholder  in  determining  the  potential  effects  of  the  century  change  on 
biomedical  equipment-to  determine  what  actions,  if  any,  should  be  taken  regarding 
manufacturers  that  have  not  provided  compliance  information.  We  also  recommended  that 
the  departments  (1)  work  jointly  to  develop  a  single  data  clearinghouse  to  provide 
compliance  information  to  all  users  of  biomedical  equipment,  and  (2)  take  prudent  steps  to 
review  test  results  for  critical  care/life  support  biomedical  equipment,  especially  equipment 
once  determined  to  be  noncompliant  but  now  deemed  compliant-and  make  those  results 
publicly  available  through  FDA's  central  data  clearinghouse. 

HHS  and  VA  agreed  with  our  recommendation  to  develop  a  single  data  clearinghouse.  FDA, 
in  conjunction  with  VA,  has  established  the  Federal  Y2K  Biomedical  Equipment 
Clearinghouse;  it  is  publicly  accessible  through  the  Internet  site  and  contains  information  on 
biomedical  equipment  compliance  submitted  to  FDA  by  manufacturers,  as  well  as 
information  gathered  by  VA  and  the  Department  of  Defense  as  part  of  their  Year  2000 
compliance  projects.  FDA  also  plans  to  include  detailed  information  on  the  make  and 
model  of  equipment  reported  as  compliant. 

In  its  February  10, 1999,  quarterly  submission  to  OMB,  HHS  reported  that  as  of  January  12, 
1999,  about  three  quarters  (1,438)  of  1,932  biomedical  equipment  manufacturers  identified 
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by  FDA  had  submitted  data  to  the  clearinghouse.  As  shown  in  figure  3,  about  40  percent  of 
the  manufacturers  have  products  that  do  not  employ  a  date,  while  about  17  percent  reported 
equipment  having  date-related  problems. 
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Figure  3:  Biomedical  Compliance  Status  Information  Reported 
To  FDA  by  Manufacturers  as  of  January  12.  1999 
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Manufacturers 
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Note:  Total  number  of  manufacturers  =  1,438. 
Source:  Department  of  Health  and  Human  Services. 
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Last  September  we  also  reoorted  that  most  manufacturers  citing  noncompliant  products 
listed  incorrect  display  of  date  and/or  time  as  the  Y2K  problem!1  According  to  VA,  these 
cases  may  not  present  a  risk  to  patient  safety  because  health  care  providers,  such  as 
physicians  and  nurses,  can  work  around  the  problem.  Of  more  serious  concern  are 
situations  in  which  devices  depend  on  date  calculations,  which  can  be  incorrect.  One 
manufacturer  cited  an  example  of  a  product  used  for  planning  delivery  of  radiation 
treatment  using  a  radioactive  isotope  as  the  source.  An  error  in  calculating  the  strength  of 
the  radiation  source  on  the  day  of  treatment  could  result  in  a  dose  that  is  too  high  or  too 
low,  which  could  have  an  adverse  effect  on  the  patient.12 

HHS  reports  that  FDA  will  continue  to  explore  ways  of  obtaining  compliance  information 
from  manufacturers  who  have  not  yet  replied.  In  response  to  our  recommendation  that  FDA 
and  VA  review  test  results  of  manufacturers'  compliance  certifications,  VA-deferring  to 
HHS-stated  that  it  did  not  have  the  legislative  or  regulatory  authority  to  do  this.  HHS,  for  its 
part,  said  that  it  lacked  the  available  resources  to  undertake  such  a  review  and,  further,  that 


"GAO/AIMD-98-240,  September  18, 1998. 

"Year  2000  Computing  Crisis:  Leadership  Needed  to  Collect  and  Disseminate  Critical 
Biomedical  Equipment  Information  fGAO/T-AIMD-98-310,  September  24, 1998). 
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insufficient  time  remained  to  complete  such  reviews  before  2000.  We  believe  that  if  HHS 
lacks  sufficient  resources  to  review  manufacturers'  test  results,  it  may  want  to  solicit  the 
help  of  federal  health  care  providers  and  professional  associations.  Finally,  HHS  stated  that 
submission  of  appropriate  certifications  of  compliance  is  sufficient  to  ensure  that  the 
certifying  manufacturers  are  in  compliance.  We  disagree.  Through  independent  reviews  of 
manufacturers'  test  results,  users  of  medical  devices  are  provided  with  a  greater  level  of 
confidence  that  the  devices  are  indeed  Year  2000  compliant. 


Mr.  Chairman,  this  completes  my  statement.  I  would  be  pleased  to  respond  to  any  questions 
that  you  or  other  members  of  this  Subcommittee  may  have  at  this  time. 


(511739) 
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Mr.  HORN.  I  thank  the  gentleman.  I  note  that  the  chairman  of 
the  Subcommittee  on  Technology  of  the  House  Committee  on 
Science  has  joined  us  and  before  we  begin  the  questioning,  if  the 
gentlewoman  from  Maryland  would  like  to  make  an  opening  state- 
ment. 

Mrs.  Morella.  Thank  you,  Mr.  Chairman.  You  invited  me  to 
participate  in  this  hearing  and  I  appreciate  it  very  much.  It  is  part 
of  our  ongoing  series  of  meetings  that  we  have  had,  and  briefings, 
to  make  sure  that  all  agencies  recognize  the  urgency  and  the  time 
limits  on  correcting  the  year  2000  computer  problem,  computer 
glitch,  mother  of  all  computer  glitches.  Certainly  my  hope  is  that 
given  what  we  understand  from  the  General  Accounting  Office 
about  the  serious  difficulties  that  HCFA  is  experiencing  with  Y2K 
that  we  can  spur  the  agency  to  undertake  the  dramatic  actions  that 
are  needed  to  ensure  that  the  population  who  receive  over  $170  bil- 
lion annually  of  Medicare  and  Medicaid  assistance,  that  their  elder- 
ly, disabled  and  indigent  benefits  continue  uninterrupted. 

Last  September  GAO  reported  that  "HCFA  and  its  contractors 
were  severely  behind  schedule  in  the  repairing,  testing,  in  the  im- 
plementing of  its  mission  critical  systems  that  support  Medicare." 
And  the  General  Accounting  Office  also  noted  that  "due  to  the  com- 
plexity and  magnitude  of  the  problem  and  HCFA's  late  start,  its 
progress  in  repairing  mission  critical  Medicare  systems  is  far  be- 
hind schedule." 

I  know  that  HCFA  disputes  some  of  the  General  Accounting  Of- 
fice's conclusions.  I  know  that  both  HHS  and  HCFA  have  dem- 
onstrated a  great  deal  of  progress  in  this  last  quarter,  so  I  look  for- 
ward to  continuing  the  dialog  and  hearing  our  other  witnesses  and 
questioning  Mr.  Willemssen. 

Thank  you  very  much,  Mr.  Chairman. 

Mr.  HORN.  I  thank  the  gentlewoman.  We  will  begin  with  the 
questioning  for  5  minutes  alternating  between  the  majority  and  mi- 
nority side.  There  are  not  too  many  questions  to  ask  the  General 
Accounting  Office.  We  will  then  move  to  panel  two  and  have  Mr. 
Willemssen  rejoin  the  panel  at  the  end  and  have  some  more  ques- 
tioning. 

Let  me  yield  the  chairman's  time  to  the  vice  chairman  of  the 
committee,  Mrs.  Biggert,  the  gentlewoman  from  Illinois. 
Mrs.  Biggert.  Thank  you,  Mr.  Chairman. 

Mr.  Willemssen,  in  the  Department's  quarterly  report  to  the  Of- 
fice of  Management  and  Budget,  the  Health  Care  Financing  Ad- 
ministration [HCFA],  reported  that  54  of  its  78  external  mission 
critical  systems  were  year  2000  compliant.  However,  in  your  testi- 
mony you  said  that  none  of  these  54  external  mission  critical  sys- 
tems are  completely  compliant  because  they  have  important  quali- 
fications or  exceptions  associated  with  them.  Do  you  think  that 
these  qualifications  are  important  and  if  so,  why? 

Mr.  Willemssen.  Yes,  we  do  think  the  qualifications  are  impor- 
tant. The  essence  of  making  systems  Y2K  compliant  is  in  part 
making  sure  that  they  are  forward  date  tested  so  that  dates  such 
as  January  1,  2000,  February  29,  2000  will  indeed  work  as  in- 
tended and  therefore  within  that  testing  it  is  important  that  those 
kinds  of  issues  have  been  fully  resolved.  At  this  point  they  have 
not.  Also,  as  of  December  31st,  the  evidence  we  saw  was  that  all 
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of  these  54  had  important  qualifications  requiring  some  amount  of 
effort  in  order  to  resolve.  If  indeed  they  involved  minor  effort,  I 
would  have  expected  that  they  would  have  been  fully  resolved  and 
tested  over  the  last  2  months.  In  fact  they  have  not.  They  continue 
to  be  outstanding.  So  although  some  resolution  has  taken  place, 
they  still  all  need  to  be  tested.  HCFA  is  making  excellent  progress 
but  not  as  much  progress  as  is  reflected  in  those  statistics. 

Mrs.  BlGGERT.  In  your  opinion  then  would  you  say  that  HCFA 
is  trying  to  gain  the  system,  trying  to  improve  its  grade  by  over- 
stating the  Y2K  compliance? 

Mr.  WlLLEMSSEN.  I  would  say  that  HCFA  is  under  tremendous 
pressure  to  do  the  best  job  possible  on  Y2K.  The  Administrator  has 
made  it  the  top  priority.  There  are  a  lot  of  people  at  HCFA  working 
very  hard,  as  are  many  contractors.  I  guess  it  is  subject  to  interpre- 
tation what  they  saw  with  the  February  16th  independent  verifi- 
cation and  validation  contractor's  report  that  they  could  possibly 
consider  the  system  substantially  compliant,  and  therefore  close 
enough,  let's  call  that  compliant. 

We  differ  with  that  view.  We  thought  those  exceptions  were  sig- 
nificant enough  that  those  systems  should  not  be  considered  com- 
pliant at  that  point  in  time. 

Mrs.  BlGGERT.  Thank  you.  Then  turning  to  the  Health  and 
Human  Services  Payment  Management  System  which  processes 
about  $170  billion  a  year  in  Federal  grant  payments,  of  concern  is 
that  HHS  has  been  trying  to  develop  a  new  Payment  Management 
System  since  1995,  as  you  mentioned,  but  with  little  success,  but 
it  is  also  still  renovating  the  current  system  to  try  to  make  it  Y2K 
compliant.  Is  the  current  system  year  2000  compliant  now? 

Mr.  WlLLEMSSEN.  No.  We  have  not  seen  the  test  results  for  the 
existing  system  demonstrating  that  it  is  indeed  compliant,  and  I 
believe  HHS  will  be  talking  about  that  a  little  bit  today  about 
whether  they  are  going  to  rely  on  the  existing  system  or  the  re- 
placement system.  But  the  evidence  that  we  have  seen  is  that  no, 
that  it  is  not  compliant  at  this  point  in  time. 

Mrs.  BlGGERT.  How  about  by  March  31,  1999  which  is  the  Presi- 
dent's deadline? 

Mr.  WlLLEMSSEN.  In  discussions  over  the  last  few  days  with 
some  of  the  key  officials  within  HHS,  at  least  one  official  main- 
tained that  he  thought  it  would  be  compliant  by  March  31st.  I  be- 
lieve HHS  may  be  amending  that  in  testimony  today  to  possibly 
being  a  few  months  later. 

Mrs.  BlGGERT.  Since — how  about  the  new  system,  will  it  be  ready 
by  March  31st  then?  If  it  is,  what  are  they  going  to  do  with  the 
old  system? 

Mr.  Willemssen.  This  is  an  issue  that  several  agencies  have  en- 
countered. The  difference  with  HHS  is  that  this  is  a  bit  late  to  be 
encountering  this,  and  in  some  cases  agencies  decide  on  a  dual 
track  approach.  That  is,  let's  continue  with  the  replacement  system 
but  with  the  risk  involved  with  that  replacement  system  of  being 
delivered  so  late,  we  need  to  go  into  the  existing  system  just  in  case 
and  remediate  and  test  that  one  so  in  the  event  the  replacement 
does  not  get  in  in  time,  we  have  this  one  to  fall  back  on.  We  would 
not  disagree  with  that  kind  of  approach  overall. 
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Mrs.  BlGGERT.  OK.  How  much  then  is  the  Department  spending 
to  develop  the  new  system  and  to  fix  the  existing  system  to  make 
it  Y2K  compliant? 

Mr.  WlLLEMSSEN.  We  do  not  have  up-to-date  information  on  the 
cost  that  we  have  gathered  over  the  last  couple  of  days,  but  we  can 
supply  the  information  for  the  record. 

Mr.  Horn.  We  will  insert  that  at  this  point  in  the  record. 

[The  information  referred  to  follows:] 


48 


April  12, 1999 

Summary  of  HHS's  Payment  Management  System  Redesign  Costs1 


Based  on  a  March  22,  1999,  report  supplied  by  HHS'  Division  of  Payment  Management 
(DPM),  DPM  reported  that  the: 

■        Original  estimated  cost  =  $4.60  million 


Current  cost  =  $6.87  million 


The  amount  over  the  original  estimate  =  $  2.27  million. 


Source:  HHS,  Program  Support  Center,  DPM. 

Note:  These  cost  figures  have  not  been  audited  or  reviewed  by  GAO. 

1  As  of  March  22.  1999. 
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Mrs.  BlGGERT.  Thank  you. 

Mr.  HORN.  I  defer  the  questioning  to  Mr.  Turner,  the  ranking 
member  of  this  subcommittee. 
Mr.  Turner.  Thank  you,  Mr.  Chairman. 

I  would  like  to  inquire  a  little  bit  into — HCFA  has  a  unique  prob- 
lem in  that  it  deals  with  a  lot  of  folks  that  it  doesn't  have  direct 
control  over,  such  as  its  contractors  and  the  States.  What  is  the 
hammer  in  terms  of  legal  control  that  HCFA  has  over  its  independ- 
ent contractors  to  be  sure  that  they  get  their  systems  in  compli- 
ance, or  are  we  just  hoping  that  they  will? 

Mr.  Willemssen.  I  think  it  is  an  excellent  point  that  you  raise. 
It  is  one  of  the  unique  challenges  that  HCFA  faces  that  many  other 
organizations  don't,  in  that  they  have  to  apply  tremendous  pres- 
sure on  the  contractors  to  get  these  systems  compliant. 

One  of  the  excellent  steps  that  they  have  taken  is  hiring  the 
independent  verification  and  validation  contractor  to  go  in  and  help 
them  make  sure  that  the  systems  are  compliant,  and  I  think  that 
contractor  has  shown  some  definite  value  over  the  last  few  months. 

But  I  think  the  legal  issues,  I  won't  pretend  to  know  them  inside 
and  out,  but  there  are  apparently  some  legal  impediments  that  the 
Administrator  may  be  more  attuned  to  speak  toward.  I  know  the 
administration  has  put  forward  some  contractor  reform  legislation 
that  it  believes  will  in  part  assist  them  in  that  area. 

Mr.  Turner.  So  we  really  don't  know  if  a  contractor  who  is  sup- 
posed to  be  sending  out  these  payments  to  all  of  these  providers, 
if  they  are  not  ready  on  January  1st  and  their  systems  go  down, 
we  don't  really  know  if  the  Federal  Government  and  HCFA  can 
hold  them  legally  responsible  for  those  noncompliant  acts  or  wheth- 
er we  can  hold  them  liable  for  damages?  Do  we  even  know  what 
we  can  do  if  a  contractor  does  not  get  in  a  situation  where  they  are 
compliant? 

Mr.  Willemssen.  With  that  legal  question  I  would  prefer  to 
defer  to  the  Administrator  since  I  do  not  know  the  legal  intricacies 
that  well  in  terms  of  what  the  Federal  Government  can  and  cannot 
do. 

Mr.  Turner.  Another  similar  issue  is  the  one  that  you  described 
regarding  the  new  system  that  was  going  to  handle  the  payment 
management  system,  the  computer  that  apparently  was  acquired 
and  put  in  place  or  attempted  to  be  put  in  place  I  believe  you  said 
in  1997.  Now  they  have  decided  well,  that  is  not  Y2K  compliant  so 
we  are  going  to  stay  with  the  old  system  through  2000.  Who  pro- 
vided that  system,  and  do  we  know  if  there  were  representations 
made  at  the  time  to  HCFA  that  was  going  to  be  Y2K  compliant? 

Mr.  Willemssen.  The  documentation  that  we  got  from  HHS  indi- 
cated that  Y2K  would  not  be  an  issue  once  the  new  system  went 
in.  Among  the  problems — I  don't  have  the  contractor  names  at  my 
disposal — but  among  the  issues  that  came  up  is  HHS  decided  to  go 
with  another  contractor  after  the  initial  contractor  because  of  some 
of  the  problems  that  they  were  experiencing  and  the  initial  contrac- 
tor not  being  able  to  meet  the  schedule.  So  for  implementation  of 
the  system,  HHS  went  with  a  second  contractor  to  do  that. 

Mr.  Turner.  To  put  in  the  new  system? 

Mr.  Willemssen.  Yes,  to  implement  that  new  system. 
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Mr.  Turner.  Do  we  know  if  that  contractor  represented  that  that 
system  they  were  providing  to  HCFA  was  going  to  be  Y2K  compli- 
ant? 

Mr.  Willemssen.  We  can  look — once  we  get  the  documents  from 
HHS,  we  can  look  at  the  contractual  language  to  see  if  indeed  the 
standard  Y2K  compliance  language  was  in  there.  The  timing  of 
that  would  be — it  may  or  may  not  have  been.  We  will  look  at  that 
for  you,  though.  There  was  some  standard  governmentwide  Y2K 
compliance  language  that  was  pulled  together  over  a  year  ago  now, 
so  it  would  be  interesting  in  terms  of  that  particular  contract  to  see 
if  that  language  has  been  put  in  or  potentially  an  amendment  put 
into  the  contract  subsequent  to  its  initial  award. 

Mr.  Turner.  I  would  certainly  hope  as  late  a  date  as  1997,  1998, 
when  all  of  this  occurred,  that  that  language  would  have  been  in 
there. 

Mr.  Willemssen.  1997,  from  a  governmentwide  perspective  gen- 
erally speaking  that  language  may  not  have  existed.  It  was  still 
being  debated  during  most  of  that  year. 

Mr.  Turner.  We  are  having  a  lot  of  hearings  on  Y2K  liability, 
and  I  think  sometimes  as  we  discuss  that  subject  we  fail  to  remem- 
ber that  the  Federal  Government  itself  may  be  a  potential  plaintiff 
making  claims  against  contractors  who  have  failed  in  a  legal  duty 
to  provide  systems  that  are  Y2K  compliant. 

If  you  looked  at  HCFA's  serious  problems  from  the  perspective 
of  those  contractors,  when  we  say  that  there  are  serious  noncompli- 
ance problems,  give  us  an  example  of  something  you  found  that  you 
are  calling  a  serious  noncompliant  problem? 

Mr.  Willemssen.  One  thing  in  looking  at  the  seriousness  of  the 
issue  is  the  tremendous  complexity  of  the  entire  claims  processing 
process  and  it  involves  so  many  players  with  so  many  individual 
systems  and  so  many  data  exchanges  that  you  have  to  look  at  it 
as  a  building  block  type  of  approach.  Each  of  those  individual  com- 
ponents we  first  have  to  get  compliant.  And  once  we  have  ascended 
that  mountain,  then  we  have  to  look  at  it  from  an  end  to  end  proc- 
ess involving  multiple  systems  and  data  flows  and  making  sure 
that  that  process  end  to  end  is  compliant,  and  that  is  one  of  the 
primary  reasons  for  our  concern  about  the  high  risk  at  HCFA.  It 
is  not  that  they  are  not  doing  what  they  can,  it  is  that  there  is  a 
relatively  limited  amount  of  time  left  to  get  it  all  done. 

Mr.  Turner.  Thank  you,  Mr.  Chairman. 

Mr.  Horn.  Thank  you.  I  now  yield  5  minutes  to  the  gentlewoman 
from  Maryland  for  questioning. 
Mrs.  Morella.  Thank  you,  Mr.  Chairman. 

We  rely  very  heavily  on  the  General  Accounting  Office  and  we 
thank  you  very  much  for  doing  the  kind  of  reporting  and  the  inves- 
tigative work  that  helps  us  move  forward.  I  can't  think  of  anything 
more  important  than  Medicare  and  Medicaid  and  then  the  whole 
medical  field  when  it  comes  to  compliance  of  Y2K. 

I  am  kind  of— I  had  a  concern  very  much  about  those  many  con- 
tractors who  are  out  there  and  how  you  pull  it  together.  But  I  am 
also  concerned  as  I  look  at  the  testimony  or  the  statement  that 
came,  the  GAO  report,  that  deals  with  Medicaid  specifically,  the 
fact  that  HCFA  distributed  a  survey  to  all  of  the  States  to  ascer- 
tain their  background  on  Y2K  compliance,  and  they  then  decided 
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they  would  rely  on  because  they  didn't  feel  that  this  was  accurate 
enough  or  complete  enough,  rely  on  onsite  contractor  visits  to  as- 
certain accurate  Medicaid  systems  status.  They  then  go  on  to  say 
that  some  States  appeared  to  make  progress  in  the  6  months  since 
the  survey  that  had  been  made,  but  many  of  the  others — four 
States  made  progress,  three  States  remained  the  same.  This  says 
something  about  the  monitoring  and  a  whole  question  about  what 
more  needs  to  be  done,  how  do  we  get  a  handle  on  this  because 
again  of  the  end  to  end  and  the  many  connections  that  have  to  be 
made  for  total  compliance  and  reliability.  I  ask  you — would  you  like 
to  comment  on  it? 

Mr.  Willemssen.  Yes.  Medicaid  systems  overall  are  of  great  con- 
cern. When  we  issued  our  report  last  year  on  State  human  services 
systems,  the  compliance  rate  that  we  saw  for  Medicaid  systems  na- 
tionwide was  only  about  16  percent  of  all  of  those  Medicaid  systems 
self  reported  to  us  by  States.  So  that  definitely  was  of  concern. 

HCFA  has  taken  some  excellent  steps  since  then.  Part  of  that 
being  hiring  a  contractor  to  go  out  and  do  on-site  visits  to  see  if 
the  States  are  making  the  progress  that  they  need  to.  HCFA's  in- 
tent is  to  go  to  all  States  and  then  for  those  States  deemed  at  risk, 
to  have  followup  visits. 

We  think  those  are  excellent  steps  that  need  to  be  taken,  but 
overall  Medicaid  has  a  long  ways  to  go.  These  are  not  simple  sys- 
tems that  are  going  to  need  to  be  made  compliant.  HCFA  is  taking 
some  aggressive  steps  to  try  to  assist,  and  again  they  are  to  be 
commended  for  doing  that. 

Mrs.  Morella.  So  basically  what  HCFA  has  done  is  hired  con- 
tractors to  go  

Mr.  Willemssen.  To  see  how  the  States  are  doing. 

Mrs.  Morella.  Do  you  feel  that  HCFA  is  going  to  be  able  to 
meet  that  March  31st  deadline  for  compliance  before  the  end-to-end 
testing  begins,  in  all  candor? 

Mr.  Willemssen.  I  doubt  that  they  will  be  able  to  make  the 
March  31st  deadline  from  the  perspective  that  we  would  see  all 
those  systems  renovated  and  tested  and  certified  compliant.  I  don't 
think  that  they  will  be  able  to  make  the  March  31st  deadline. 

Mrs.  Morella.  What  do  you  think  the  consequences  will  be  and 
what  do  you  think  we  should  do  about  it? 

Mr.  Willemssen.  The  consequences  of  that  are  that  the  addi- 
tional— as  you  mentioned  the  end  to  end  testing,  the  period  for  that 
will  get  squeezed  tighter;  and,  therefore,  the  thoroughness  and 
depth  of  that  testing  will  not  be  as  much.  HCFA  has  made  an  ex- 
cellent commitment  toward  the  need  to  put  together  contingency 
plans  so  that  they  have  backup. 

Mrs.  Morella.  I  would  assume  that  contingency  plans  are  al- 
ready there  and  have  been  worked  on.  Am  I  assuming  too  much? 
Do  they  not  have  contingency  plans? 

Mr.  Willemssen.  They  are  aggressively  working  on  those  plans 
currently. 

Mrs.  Morella.  Which  means  that  they  do  not  have  them  yet? 

Mr.  Willemssen.  Their  timetable  I  believe  is  to  have  them  done 
and  tested  I  believe  by  approximately  the  end  of  June,  so  that  will 
give  them  some  time.  From  a  governmentwide  perspective,  that  is 
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not  out  of  the  realm  of  what  the  deadline  should  be  for  doing  that. 
That  is  pretty  good. 

Mrs.  Morella.  Do  you  see  something  more  that  Congress  can  do 
to  encourage,  forge,  require?  What  else  can  we  do?  These  are  sys- 
tems that  so  many  people  statistically,  as  we  have  mentioned,  are 
affected  by? 

Mr.  Willemssen.  One,  it  is  important  to  continue  to  have  this 
kind  of  oversight  on  a  critical  program  such  as  this  to  keep  up  to 
date  on  what  kind  of  progress  and  impediments  there  are  for  Medi- 
care. 

Second,  I  think  you  should  also  ask  the  question  of  HCFA,  what 
do  you  need  from  us?  What  is  getting  in  your  way?  Whether  it  is 
some  of  the  legal  issues  that  we  discussed  earlier,  that  contractor 
reform  is  necessary  because  we  can't  get  the  contractors  to  do  what 
we  tell  them  if  indeed  that  is  the  case.  I  think  that  is  a  very  useful 
question  to  ask  of  HCFA  also. 

Mrs.  Morella.  Thank  you,  Mr.  Willemssen.  My  time  is  up. 

Mr.  Horn.  Thank  you  very  much.  I  now  yield  to  the  ranking 
member  of  the  House  Science  Subcommittee  on  Technology,  Mr. 
Gordon  of  Tennessee. 

Mr.  Gordon.  Thank  you,  Mr.  Chairman. 

Welcome,  Mr.  Willemssen.  I  want  to  thank  you  and  the  General 
Accounting  Office  for  the  important  role  that  you  have  played  in 
the  oversight  and  watchdog  of  all  of  these  agencies.  As  I  think  you 
just  mentioned,  the  more  oversight,  the  more  we  can  talk  about 
this  and  bring  it  out,  the  better  off  we  are. 

Let  me  ask  you,  do  you  feel  that  Congress  has  provided  adequate 
funds  or  enough  funds  for  HCFA  to  maximize  their  effort  to  correct 
this  problem? 

Mr.  Willemssen.  I  am  not  aware  at  HCFA  or  actually  any  other 
agency  where  they  have  made  requests  for  funds  for  Y2K  and  those 
requests  have  been  denied. 

So  again  an  extremely  useful  question  to  ask  of  HCFA,  do  you 
need  more  resources,  more  funds  because  at  many  of  the  hearings 
that  I  have  testified  at,  that  is  a  common  question  asked  of  many 
agencies.  If  you  need  more  resources,  please  tell  us  and  we  will  do 
what  we  can. 

As  you  know,  last  year  the  Congress  passed  a  $3.35  billion  emer- 
gency fund  so  that  agencies  such  as  HCFA  and  others  could  tap 
into  that  fund  if  indeed  they  needed  those  additional  resources. 

Mr.  Gordon.  Thank  you.  I  will  ask  that  question  later. 

Let  me  ask  you  also,  Chairman  Horn's  report  card  I  think  has 
been  helpful  in  trying  to  raise  awareness  of  the  problem.  If  you  had 
your  own  report  card  and  you  were  grading  the  focus  and  the  at- 
tention that  HCFA  is  placing  on  this  problem,  what  grade  would 
you  give? 

Mr.  Willemssen.  If  we  were  grading  in  terms  of  the  current 
focus  of  what  HCFA  is  placing  on  this  problem,  given  that  the  Ad- 
ministrator has  named  it  her  No.  1  priority  and  given  that  many 
of  her  staff  are  working  on  it,  it  is  hard  to  give  less  than  a  top 
grade  given  where  the  priority  stands  within  HCFA  and  given  the 
kind  of  progress  they  have  made  since  our  September  report. 

Mr.  Gordon.  Thank  you,  Mr.  Chairman. 
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Mr.  HORN.  We  are  now  going  to  bring  forward  the  second  panel. 
We  are  going  to  swear  them  in  and  then  Mr.  Gordon  will  have  the 
honor  of  introducing  the  members. 

[Witnesses  sworn.] 

Mr.  Horn.  The  clerk  will  note  that  both  witnesses  have  affirmed 
the  oath,  and  I  yield  to  Mr.  Gordon  to  introduce  the  panel. 

Mr.  Gordon.  Thank  you,  Mr.  Chairman.  We  have  all  sat  through 
a  number  of  hearings  with  well-informed  witnesses,  but  you  don't 
really  know  them,  I  don't  think  that  their  testimony  is  as  real 
sometimes,  so  I  want  you  to  get  to  know  these  two  folks  a  little  bit 
better. 

First,  John  Callahan.  Dr.  John  Callahan  and  I  first  met  almost 
20  years  ago  when  he  served  as  a  very  Yankee  chief  of  staff  to  a 
very  southern  Senator  and  even  with  that  impediment  he  did  a 
very  good  job  partly  because  there  are  a  lot  of  lawyers  around  here, 
but  not  too  many  doctors  or  PhDs. 

Mr.  Horn.  Will  the  gentleman  yield.  When  I  hear  that  I  am  re- 
minded of  the  great  line  of  William  White,  who  covered  the  Senate 
for  the  New  York  Times,  who  said,  "The  Senate  is  the  South' s  re- 
venge on  the  North  for  having  lost  the  Civil  War." 

Mr.  Gordon.  Well,  John  did  a  good  job  there.  And  then  he  went 
over  to  Assistant  Secretary  in  HHS.  When  there  became  an  open- 
ing at  Social  Security,  they  needed  somebody  to  fill  in,  and  John 
went  over  and  did  a  very  competent  job  of  being  the  acting  Director 
of  Social  Security;  and  now  he  has  become  at  HHS  an  Assistant 
Secretary  and  John,  I  am  glad  you  are  here. 

And  Nancy-Ann  DeParle  is  a  good  friend  from  home,  an  old 
friend  from  home.  And  let  me  tell  you  about  Nancy- Ann.  She  grew 
up  with  her  mother  in  Rockwood,  TN,  and  Rockwood  is  just  about 
as  tough  as  the  name  sounds.  Nancy-Ann  was  fortunate  enough  to 
get  a  scholarship  to  go  to  the  University  of  Tennessee  and  I  think 
UT  feels  it  was  a  good  investment  because  Nancy-Ann  became  the 
first  woman  student  body  president  of  their  20,000-plus  campus  in 
its  almost  200-year  history,  and  became  a  Rhodes  Scholar  and  went 
on  to  Yale,  graduated  with  honors  from  law  school  and  turned 
down  offers  all  around  the  country  to  come  home,  and  I  am  glad 
she  did. 

After  she  got  home  and  she  was  trying  to  pay  off  some  bills,  our 
Governor  asked  her  to  be  his  commissioner  for  human  services,  and 
Nancy-Ann  really  didn't  have  any  background  in  the  health  care 
area,  but  she  knew  how  to  get  things  done.  So  she  became  the 
youngest  and  the  shortest  member  of  Governor  Borders  cabinet,  in- 
stituted a  number  of  new  information  systems  that  tremendously 
reduced  the  error  rate  in  food  stamps  and  the  welfare  program, 
went  back  to  the  private  sector  and  then  Leon  Panetta  gave  her  a 
call  and  said  we  hope  you  will  come  to  OMB  to  head  up  our  health 
care  area.  She  did,  did  a  very  good  job  and  then  was  appointed  the 
Director  of  HCFA. 

And  it  was  interesting  at  the  time  she  got  that  appointment 
Chairman  Morella  and  I  had  our  first  hearing  on  the  Y2K  problem, 
and  so  I  wrote  Nancy  and  said  we  just  had  this  hearing,  and  I 
think  there  is  a  potential  for  a  real  problem  and  you  ought  to  check 
HCFA  and  see  what  is  being  done. 
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She  called  me  later,  somewhat  frustrated  that  virtually  nothing 
had  been  done.  I  don't  think  there  is  a  conversation  that  we  have 
had  since  then  that  we  haven't  discussed  her  focus.  And  with  all 
of  them,  the  new  responsibilities  that  Congress  has  placed  on 
HCFA,  Nancy-Ann  has  made  this  her  first  priority.  I  know  that 
daily  she  works  at  it  and  worries  about  it  and  tries  to  get  a  handle 
on  it. 

I  am  glad  that  she  is  here  to  give  us  her  experiences,  and  I  have 
to  say  that  really  Nancy-Ann  to  me  epitomizes  all  that  is  best 
about  the  American  dream  in  this  country. 

Mr.  Horn.  We  thank  you  for  that  delightful  introduction  and  we 
thank  the  witnesses  for  being  with  us.  However  you  would  like  to 
proceed,  please  do. 

STATEMENTS  OF  NANCY-ANN  DEPARLE,  ADMINISTRATOR, 
HEALTH  CARE  FINANCING  ADMINISTRATION;  AND  JOHN  J. 
CALLAHAN,  CHIEF  INFORMATION  OFFICER,  DEPARTMENT 
OF  HEALTH  AND  HUMAN  SERVICES 

Ms.  DeParle.  Thank  you,  Chairman  Horn,  Congressman  Turner, 
and  distinguished  committee  members.  We  appreciate  the  oppor- 
tunity to  be  here  today  to  talk  about  the  progress  of  the  Health 
Care  Financing  Administration  in  meeting  the  year  2000  challenge. 
I  have  with  me  Dr.  Gary  Christoph  who  I  brought  in  from  Los  Ala- 
mos National  Laboratory  a  year  ago  to  lead  our  information  tech- 
nology efforts. 

We  have  a  great  deal  to  do,  Mr.  Chairman,  but  we  are  making 
good  progress  and  we  will  be  ready  well  before  January  1,  2000. 
Our  main  job  is  financing  the  health  care  for  Medicare  bene- 
ficiaries. We  can  assure  that  our  claims  processing  and  payment 
systems  work  and  that  doctors  and  hospital  bills  will  get  paid,  but 
continuity  of  care  depends  on  much  more.  Doctors,  hospitals  and 
other  providers  must  ensure  that  they  are  also  ready.  We  are 
therefore  engaging  in  an  unprecedented  outreach  effort  to  help  our 
partners  reach  their  responsibilities. 

Just  2  months  ago  I  personally  wrote  each  and  every  one  of  the 
1.3  million  health  care  providers  in  the  country  who  work  in  the 
Medicare  program  to  make  sure  that  they  were  aware  of  this  prob- 
lem and  to  give  them  information  about  what  they  needed  to  do  to 
be  fixing  it,  and  we  will  also  be  doing  special  outreach  to  critical 
access  providers  and  Medicare  sole  providers  to  make  sure  that 
they  are  ready. 

We  have  aggressively  attacked  our  part  of  the  problem,  and  I 
have  to  say  to  Congressman  Gordon,  it  seems  like  it  has  been 
about  10  years  since  we  had  that  conversation,  but  you  are  exactly 
right.  It  is  my  No.  1  priority.  We  have  to  continue  to  re  test  systems 
and  refine  contingency  plans,  but  I  do  think  that  we  have  come  a 
long  way  since  I  became  Administrator. 

To  get  to  this  point,  we  had  to  make  some  difficult  decisions,  in- 
cluding delaying  implementation  of  some  of  the  Balanced  Budget 
Act  provisions  and  I  want  to  thank  the  committee  for  your  leader- 
ship and  support  in  helping  us  make  those  decisions.  We  did  reach 
a  significant  milestone  in  December  when  we  reported  that  all  25 
internal  mission  critical  systems  are  now  compliant,  and  those  in- 
clude the  systems,  Congresswoman  Biggert,  that  pay  Medicaid 
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claims  and  managed  care  claims.  They  are  the  systems  under  our 
direct  control.  And,  Mr.  Chairman,  you  and  I  had  a  conversation 
about  the  complexity  of  this,  and  you  remembered  from  your  expe- 
rience on  the  Senate  side  how  Medicare  was  set  up  with  all  of  the 
different  contractors  around  the  country,  and  that  has  been  a  big 
part  of  our  problem,  as  has  been  noted  this  morning. 

One  of  the  first  things  that  I  did  when  I  got  to  HCFA  was  sit 
down  with  Joel  Willemssen  and  Gene  Dodaro  from  GAO  to  ask 
them  what  I  needed  to  do,  and  they  made  a  couple  of  recommenda- 
tions. One  was  to  amend  the  contracts  that  we  have  with  our  con- 
tractors to  require  them  to  be  compliant  by  the  end  of  December 
of  last  year.  That  turned  out  to  be  more  difficult  than  it  sounds. 
The  contractors  initially  said  no,  they  were  not  going  to  sign  it. 
They  testified  to  the  Ways  and  Means  Committee  that  they  didn't 
think  that  I  had  the  authority  to  require  that,  and,  in  fact,  under 
the  contracts  that  Medicare  has  that  are  different  than  any  other 
government  contracts,  there  have  been  questions  about  the  author- 
ity that  the  Secretary  and  I  have  to  hold  them  compliant  for  things 
like  this.  But  we  did  in  fact  succeed  in  getting  a  contract  amend- 
ment. And  by  the  end  of  December  31,  1998  we  had  certified  that 
78  of  the  external  mission  critical  systems  had  been  renovated,  in 
other  words  the  50  million  lines  of  code  had  been  repaired,  and  54 
had  been  self-certified  as  compliant.  That  meant  that  they  had 
completed  three  levels  of  testing  by  December  31,  1998. 

Let  me  stress  that  self-certification  does  not  mean  that  our  work 
is  finished.  It  does  mean  that  the  software  has  been  renovated  and 
tested  and  that  those  systems  were  able  to  process  and  pay  claims 
with  future  dates. 

We  have  greatly  appreciated,  and  I  have  personally  benefited 
greatly  from,  the  diligence  of  GAO  in  advising  us  on  this  project. 
But  as  you  heard  this  morning,  there  is  a  difference  of  opinion  be- 
tween us  and  our  colleagues  at  GAO  on  the  exact  nature  and  ex- 
tent of  the  qualifications  that  we  received  with  the  self-certifi- 
cations from  the  contractors. 

And  I  want  to  note  that  there  has  been  some  discussion  of  our 
December  submission  and  I  brought  with  me  just  the  pages  that 
relate  to  this,  from  a  letter  to  you  in  early  February  that  contained 
4  or  5  pages  of  what  the  qualifications  were  on  the  24  contractors 
that  we  did  not  accept.  The  GAO  believes  that  all  of  the  qualifica- 
tions should  have  been  removed  before  certifications  were  accepted. 
We  believe  that  the  qualifications  that  we  allowed  were  minor  and 
don't  go  to  the  heart  of  the  claims  processing,  and  as  I  said,  we  out- 
lined each  and  every  contractor  that  we  thought  had  a  problem 
that  was  significant  enough  that  we  were  not  going  to  accept  their 
certification. 

I  directed  our  staff  to  be  very  conservative.  With  all  respect  to 
you,  Mr.  Chairman,  I  care  about  your  grade,  but  I  care  much  more 
about  making  sure  that  the  systems  are  renovated  and  tested  prop- 
erly and  there  is  no  disruption  in  services.  I  was  not  looking  to  in- 
crease my  grade.  I  was  looking  to  be  as  conservative  as  we  could 
be.  We  went  on-site  at  all  of  these  places.  We  didn't  just  look  at 
the  paper  qualifications.  And  we  believe  that  these  contractors 
have  made  the  kind  of  progress  that  we  needed  to  note  to  you  at 
that  time. 
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We  are  continuing  to  closely  monitor  this  situation  and  we  have 
established  a  war  room  in  our  Baltimore  headquarters.  We  have 
special  teams  of  people  who  have  been  asked  to  leave  their  homes 
and  work  at  these  contractors  so  that  I  know,  frankly,  on  day-to- 
day basis  what  is  actually  happening  on  the  ground.  And  we  are 
developing  comprehensive  business  continuity  and  contingency 
plans  in  case  any  unforeseen  problems  arise.  We  are  through  our 
third  draft  of  our  proposed  plan,  and  we  plan  to  have  that  done  in 
June. 

The  GAO  and  our  IV&V  contractor  have  identified  essential  work 
that  remains  for  all  of  our  systems  to  be  millennium-ready,  and  we 
agree  with  the  GAO  that  one  of  the  most  critical  tasks  is  testing 
our  many  data  exchanges  to  make  sure  that  all  of  our  interdepend- 
ent systems  function  together  properly. 

We  also  have  to  continue  end  to  end  testing  from  the  point  of 
claim  submission  to  the  point  of  sending  a  payment  instruction  to 
a  bank  and  printing  a  notice  to  a  beneficiary.  And  we  have  to  con- 
tinue working  with  providers,  and  this  is  the  area  where  Congress 
can  help  us  the  most. 

After  I  wrote  a  letter  to  each  and  every  one  of  the  providers,  I 
also  sent  every  Member  of  Congress  a  copy  of  that  letter  and  asked 
for  you  to  help  us.  We  have  speakers  available  to  go  out  to  your 
districts  and  meet  with  providers.  We  will  do  whatever  will  help. 
We  are  also  meeting  with  providers  here  and  with  the  trade  asso- 
ciations, and  we  want  to  get  out  across  the  country. 

The  good  news  is  that  we  have  given  providers  a  deadline  by 
when  they  have  to  submit  compliant  claims,  and  many  of  them  are 
already  doing  so.  About  98  percent  of  the  submitters  who  submit 
on  the  part  B  side  are  submitting  compliant  claims  right  now.  And 
on  the  part  A  side,  from  December  to  January,  it  increased  by 
about  30  percent.  We  are  at  58  percent  there. 

So  that  is  the  good  news,  but  we  also  are  going  beyond  current 
industry  practice  on  testing  and  everything  else.  We  are  now  in- 
structing our  contractors  across  the  country  to  begin  testing  with 
those  providers  around  the  country  who  want  to  submit  future  date 
claims  to  test  that. 

We  hope  that  will  build  provider  confidence.  If  they  want  to  test 
claims,  they  can  do  so.  For  especially  critical  systems,  we  are  going 
another  level  beyond  the  GAO's  guidance  by  having  the  independ- 
ent contractor  perform  independent  tests  in  isolated  future  date  en- 
vironments. 

We  also  have  to  finish,  test  and  refine  our  contingency  plans  and 
we  are  doing  that  in  accordance  with  the  GAO's  advice. 

In  short,  Mr.  Chairman,  we  have  much  more  to  do  and  we  fully 
expect  that  there  may  be  bumps  in  the  road,  but  I  want  to  assure 
you  that  we  are  committed  to  doing  everything  we  have  to  do.  This 
is  our  No.  1  priority.  All  of  this  would  have  been  a  lot  harder  with- 
out your  leadership,  Mr.  Chairman,  and  without  Congress'  support, 
and  I  want  to  thank  you  for  that  as  well  as  for  the  hard  work  that 
our  colleagues  at  GAO  continue  to  do  on  our  behalf,  and  I  am 
happy  to  answer  your  questions. 

[The  prepared  statement  of  Ms.  DeParle  follows:] 
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Testimony  of  Nancy-Ann  DeParle.  Administrator 
Health  Care  Financing  Administration 
on  the 

YEAR  2000  CHALLENGE 

before  the 
House  Government  Reform 
Subcommittee  on  Government  Management, 
Information,  &  Technology 
February  26,  1999 

Chairman  Horn,  Congressman  Turner,  distinguished  committee  members,  thank  you  for  im-iing 
me  here  today  to  discuss  my  highest  priority  -  the  Year  2000  computer  challenge.  I  am  harpy  to 
report  today  that,  despite  serious  concerns  about  the  Health  Care  Financing  Administration  > 
(HCFA)  ability  to  meet  this  challenge,  we  are  making  remarkable  progress.  In  fact,  I  am 
confident  that  HCFA's  own  Year  2000  systems  issues  will  be  resolved  well  before  January  1. 
2000. 

Our  foremost  concern  has  been,  and  continues  to  be,  ensuring  that  our  more  than  70  million 
Medicare,  Medicaid  and  Children's  Health  Insurance  Program  (CHIP)  beneficiaries  continue  to 
receive  the  health  care  services  they  need.  We  are  aggressively  addressing  Year  2000  issues  in 
those  systems  over  which  we  have  responsibility.  And  we  are  engaging  in  an  unprecedented 
outreach  effort  to  raise  awareness  and  provide  information  to  those  other  parts  of  the  health  care 
system  where  we  have  little  authority  and  control.  I  want  to  personally  assure  beneficiaries  :hat 
the  care  they  have  come  to  expect  from  our  programs  will  continue  throughout  the  millennium 
transition. 

Although  our  Year  2000  work  is  not  yet  complete,  we  have  already  accomplished  a  great  deal. 
*■        All  25  of  our  internal  mission-critical  systems  are  now  certified  as  Year  2000  compliant, 
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three  months  ahead  of  the  government-wide  deadline  of  March  31,  1999 

►  All  78  of  our  external  mission-critical  claim  processing  systems  that  our  claims  processing 
contractors  use  to  pay  bills  are  renovated.  Of  these,  54  have  been  self-certified  as 
compliant.  Our  independent  verification  and  validation  (IV&V)  expert  contractor  has 
rated  1 7  systems  as  highly  compliant  and  will  require  only  a  minimal  effort  to  resolve  any 
remaining  issues;  another  39  will  require  a  moderate  level  of  effort.  We  will  recertify  all 
mission-critical  systems  before  October  1999. 

►  And  27  of  our  55  non-mission  critical  internal  systems  are  certified  as  compliant. 

We  recognize  the  importance  of  our  programs  to  our  beneficiaries  and  have  put  together  a 
vigorous  Year  2000  program,  with  extensive  testing  and  independent  review.  We  have  asked  our 
IV&V  contractor  to  set  rigorous  performance  measures  and  be  hard  in  their  judgment  of  our 
contractors'  progress. 

As  mentioned  above,  54  of  our  external  contractors'  claims  processing  systems  are  self-certified 
as  compliant.  We  and  our  IV&V  contractor  have  noted  that  this  does  not  mean  our  entire  claims 
processing  environment  is  completely  ready.  It  does  mean  that  the  software  for  these  systems  has 
been  renovated  and  made  compliant,  and  that  the  systems  have  been  proven,  by  extensive  testing, 
to  be  able  to  pay  claims  with  future  dates.  These  renovated  systems  are  currently  implemented  for 
claims  processing.  Self-certification  of  these  systems'  compliance  was  a  critical  milestone  in 
becoming  Year  2000  ready. 
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We  acknowledge  that  not  every  piece  of  hardware,  nor  every  system  that  does  not  go  to  the  heart 
of  claims  processing  is  compliant.  However,  for  54  of  the  78  systems,  we  are  confident  that  the 
qualifications  are  not  substantial  enough  to  warrant  a  non-compliant  status.  Our  IV&V 
contractor  agrees  with  us. 

For  the  remainder  of  1999,  we  will  continue  to  renovate,  test,  and  retest  our  systems.  We  are 
ahead  of  schedule  on  our  internal  mission-critical  systems,  and  are  well  on  our  way  to  meeting  the 
Federal  government's  deadline  for  our  external  systems.  We  will  certainly  be  ready  before 
January  1,  2000. 

I  want  to  be  clear  about  what  HCFA  can  and  cannot  do.  We  are  responsible  for  financing  health 
care  for  our  beneficiaries.  We  can  assure  that  our  claims  processing  and  payment  systems  will 
work  and  that  doctors  and  hospital  bills  will  be  paid.  Ensuring  continuity  of  care  for  our 
beneficiaries,  however,  goes  well  beyond  processing  payments  successfully.  It  depends  on  a  host 
of  other  entities  ensuring  that  their  own  systems  are  compliant,  such  as  States,  doctors,  hospitals, 
and  other  service  providers.  And  it  depends  on  the  continued  operation  of  pharmaceutical  and 
medical  supply  chains,  as  well  as  basic  utility  and  telecommunication  services.  HCFA  does  not 
have  the  authority,  ability,  or  resources  to  step  in  and  fix  systems  for  others,  such  as  States  and 
providers.  And  that  leads  to  a  rather  substantial  concern  that  we  need  the  help  of  Congress  and 
others  to  fully  address. 
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HCFA's  Year  2000  Efforts 

There  is  no  question  that  we  have  faced  an  uphill  battle  in  achieving  Year  2000  compliance  A 
number  of  key  steps  are  getting  us  where  we  need  to  be.  They  include: 

►  Building  a  "War  Room"  in  our  Baltimore  headquarters  dedicated  solely  to  tracking  Year 
2000  efforts  on  a  daily  basis  not  only  within  our  own  agency,  but  also  with  our  partners 
across  the  country.  I  can  now  find  out  what  is  happening  on  any  of  our  essential  Year 
2000  projects  at  a  moment's  notice.  That  is  something  I  could  not  do  last  year. 

*        Establishing  contractor  oversight  teams  specifically  responsible  for  closely  monitoring 
and  managing  Year  2000  work  for  all  contractors  involved  in  processing  Medicare  claims. 
These  oversight  teams  include  staff  who  are  on-site  overseeing  and  helping  contractors 
who  most  need  assistance  in  meeting  the  March  31.  1999.  deadline.  They  also  provide 
timely  information  on  the  status  of  contractors'  progress  to  the  War  Room. 

►  Negotiating  amendments  to  contracts  with  more  than  60  claims  processing  contractors. 
These  amendments  established,  for  the  first  time,  clear  requirements  that  contractors  must 
meet  for  their  information  systems  to  be  Year  2000  compliant. 

►  Hiring  AverStar.  Inc.,  formerly  Intermetrics,  Inc..  an  IV&V  contractor  to  provide 
assurance  that  our  Year  2000  work  is  done  right.  They  have  helped  us  refine  our 
renovation  processes,  audit  our  testing  plans  and  processes,  as  well  as  measure  our 
progress. 

Hiring  Seta  Corporation,  another  contractor  providing  independent  testing  of  especially 
critical  systems,  to  further  ensure  that  the  Year  2000  work  on  these  systems  has  been  done 
correctly.  This  additional  testing  goes  beyond  that  described  by  GAO. 
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+        Helping  States  by  hiring  another  IV&V  contractor,  TRW.  to  visit  every  state  and  validate 
their  Year  2000  progress.  TRW  is  giving  us  direct  information  regarding  the  status  of 
States'  renovation  efforts  on  critical  areas,  such  as  Medicaid  enrollment  and  claims 
processing  systems.  We  also  are  providing  the  States  with  whatever  information  and 
insights  we  can. 

+        Helping  providers  learn  what  they  must  do  to  prepare  for  the  new  millennium  through  an 
unprecedented  provider  outreach  campaign.  This  broad  effort  includes  mailings, 
publications,  an  Internet  site,  a  speakers'  bureau,  a  number  of  seminars  and  conferences, 
and  a  wide  range  of  other  efforts. 

Scope  of  HCFA's  Year  2000  Workload 

The  Year  2000  especially  affects  the  programs  HCFA  administers  because  of  our  extensive 
reliance  on  multiple  computer  systems.  More  than  1 50  different  systems  are  used  by  HCFA  in 
administering  the  Medicare  program.  About  100  of  these  systems  are  considered  mission-critical. 
These  systems  are  responsible  for  establishing  beneficiary  eligibility  and  making  payments  to 
providers,  plans,  and  States. 

Medicare  is  the  most  automated  health  care  payer  in  the  country.  We  process  nearly  one  billion 
claims  annually,  most  electronically.  In  fact,  97  percent  of  inpatient  hospital  and  other  Medicare 
Part  A  claims  and  8 1  percent  of  physician  and  other  Medicare  Part  B  claims  are  submitted 
electronically  to  the  Medicare  claims  processing  contractors.  Most  claims  are  processed  to 
payment  by  entirely  electronic  means.  This  high  level  of  electronic  billing  has  allowed  us  to 
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achieve  significant  operating  efficiency  and  cost  savings.  This  reliance  on  automated  systems, 
however,  has  made  the  Year  2000  computer  fix  a  major  challenge.  Critical  dates  in  computerized 
claims  processing  include  the  date  a  beneficiary  became  eligible,  the  date  a  patient  was  admitted 
or  discharged  from  a  hospital,  the  date  a  wheelchair  rental  began,  or  the  date  an  enrollee  entered  a 
managed  care  plan. 

Renovating  all  these  systems  has  been  complicated.  Each  system  used  by  our  programs  and  our 
60-plus  claims  processing  contractors,  as  well  as  interfaces  with  State  Medicaid  programs, 
banking  institutions  and  some  1.3  million  providers  has  to  be  thoroughly  reviewed  and  renovated 
by  those  responsible  for  each  particular  system.  Our  renovation  standards  require  that  systems  be 
tested  individually,  as  well  as  with  the  exchanges  they  perform  with  other  partners. 

To  fix  the  Medicare  systems  alone,  we  have  had  to  renovate  some  49  million  lines  of  internal  and 
external  systems  code  to  find  date-sensitive  processes.  We  have  had  to  repair  all  of  our 
Medicare-specific  software  so  it  will  work  with  new  versions  of  vendor-supplied  software.  We 
have  had  to  update  the  operating  systems  that  drive  the  hardware  we  use  with  millennium 
compliant  versions.  We  also  have  had  to  test  and  upgrade  deficient  operational  hardware, 
including  our  telecommunications  equipment  and  software.  And  we  must  assure  that  all  data 
exchanges  with  thousands  of  our  partners  will  function  properly. 

Contingency  Planning 

Although  we  fully  intend  to  have  our  own  systems  ready  long  before  January  1,  2000,  we  know 
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we  must  be  prepared  in  case  any  unanticipated  problems  arise.  We  are  undertaking  an  extensive 
effort  to  develop  contingency  plans  for  all  our  mission-critical  business  processes.  Our  top 
priorities  in  developing  these  plans  are  to: 

►  Process  claims  so  as  to  be  able  to  pay  providers  promptly: 

►  Prevent  payment  errors  and  potential  fraud  and  abuse; 

►  Ensure  quality  of  care;  and 
-        Enroll  beneficiaries. 

Contingency  planning  is  an  Agency-wide  effort  with  active  participation  of  all  of  our  most  senior 
executives.  We  are  closely  following  the  GAO's  advice  on  contingency  planning  which  they 
outlined  in  their  August  1998  guidance,  Year  2000  Business  Continuity  and  Contingency 
Planning  and  in  their  September  1998  report,  Medicare  Computer  Systems  —Year  2000 
Challenges  Put  Benefits  and  Services  in  Jeopardy. 

We  recently  completed  the  second  phase  of  the  contingency  planning  process  by  reviewing  280 
Medicare  business  processes,  performing  risk  and  impact  analyses,  and  identifying  the  potential 
impact  of  mission-critical  failures.  We  are  now  in  the  third  phase  in  which  we  will  clarify  and 
document  our  contingency  plans  and  implementation  modes,  define  events  that  will  trigger  use  of 
the  plans,  as  well  as  establish  and  train  implementation  teams  should  the  need  arise  to  execute  the 
plans. 
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Protecting  Beneficiaries 

I  must  stress  that  our  concern  must  always  be  focused  first  and  foremost  on  protecting  the 
beneficiaries  and  their  continued  access  to  care  Providers  who  fail  to  fix  their  own  systems,  and 
thus  are  unable  to  bill  us  for  services,  are  strictly  prohibited  from  billing  beneficiaries. 
Beneficiaries  are  legally  protected  from  liability  for  bills  that  Medicare  would  ordinarily  pay,  even 
if  the  provider  is  not  Year  2000  compliant.  To  safeguard  beneficiaries  in  the  new  millennium,  we 
will  provide  them  with  a  phone  number  to  call  to  report  any  inappropriate  billings  they  receive 
from  providers  or  any  difficulties  they  encounter  in  accessing  care.  Our  beneficiaries  are  counting 
on  us.  Their  health  care  needs  will  continue  regardless  of  what  day  it  is. 

Concern  for  States  and  Providers 

It  is  not  enough  for  HCFA  alone  to  be  ready  for  the  Year  2000  Health  care  provider  computers 
and  systems  must  be  Year  2000  compliant  in  order  for  providers  to  be  able  to  generate  and  submit 
bills  to  us.  State  computers  and  systems  also  must  be  Year  2000  ready  for  Medicaid  and  CHIP  to 
continue  uninterrupted  payment  of  services.  Many  States  and  providers  will  meet  the  Year  2000 
challenge  on  time.  However,  monitoring  by  us  and  the  General  Accounting  Office  (GAO) 
indicates  that  some  States  and  providers  could  well  fail.  This  is  the  first  time  any  of  us  have  had 
to  deal  with  such  a  problem,  and  we  at  HCFA  are  eager  to  share  the  lessons  we  have  learned 
along  the  way.  We  are  providing  assistance  to  the  extent  that  we  are  able.  But  that  likely  will  not 
be  enough.  This  matter  is  of  urgent  concern,  and  literally  grows  in  importance  with  each  passing 
day. 
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Our  own  progress  in  meeting  the  Year  2000  challenge  is  due  in  large  part  to  the  outstanding 
effort  and  commitment  of  staff  throughout  HCFA  and  at  our  Medicare  contractors.  We  have 
been  greatly  aided  by  wise  counsel  from  the  GAO.  and  especially  by  the  expert  IV&V  contractors 
we  hired,  based  on  the  GAO's  recommendations,  to  ensure  that  our  Year  2000  work  is  done 
correctly.  And,  importantly,  we  could  not  have  come  so  far  so  quickly  without  the  timely  support 
and  funding  that  Congress  has  provided. 

Providers'  Progress 

Providers  must  ready  their  own  systems  for  the  Year  2000  in  a  timely  manner  if  the  health  care 
system  is  to  meet  the  millennium  challenge  completely  and  successfully.  One  of  the  first  steps, 
and  perhaps  the  easiest,  is  changing  the  format  of  Medicare  claims  to  allow  for  8-digit  date  fields. 
Our  electronic  claims  monitoring  indicates  that  over  98  percent  of  Part  B  claims  submitters  (either 
physicians/suppliers  or  their  billing  agents)  are  submitting  claims  with  8-digit  date  fields.  Fifty- 
eight  percent  of  Part  A  submitters  (hospitals  and  other  institutions  or  their  billing  agents)  that 
submit  claims  electronically  are  also  using  the  8-digit  fields. 

It  is  essential  that  all  providers  address  the  Year  2000  issue.  Thus,  we  recently  announced  that 
we  would  require  all  claims  submitters  to  start  using  the  8-digit  date  format  by  April  5,  1999. 
Claims  received  on  or  after  that  date  without  the  new  format  will  not  be  accepted.  That  does  not 
mean  that  providers  need  to  be  fully  compliant  by  April  5,  but  it  does  mean  that  we  want  to  be 
assured  that  they  have  started  to  prepare  their  systems  by,  at  least,  taking  this  first  step. 
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We  recognize  that  providers  should  be  able  to  test  whether  Year  2000-compliant  claims  can  be 
accepted  by  our  claims  processing  contractors.  We  are  now  instructing  our  claims  processing 
contractors  to  begin  testing  with  those  providers  throughout  the  country  who  want  to  submit 
future-dated  claims. 

We  are  concerned  that  providers  address  other  Year  2000  issues  as  well,  not  just  billing  and 
claims  system  issues.  To  ensure  continued  patient  care,  providers  must  take  appropriate  Year 
2000  remediation  steps  to  prepare  biomedical  devices,  as  well  as  clinical  and  other  systems. 

Provider  Outreach. 

Due  to  the  critical  need  for  providers  to  become  Year  2000  compliant,  we  have  launched  a  broad 
outreach  campaign.  Last  month,  in  an  unprecedented  step,  we  mailed  a  letter  to  all  1.3  million 
providers  serving  our  beneficiaries  explaining  the  gravity  of  the  Year  2000  problem  and  providing 
a  checklist  for  what  must  be  done  to  achieve  compliance. 

Our  provider  outreach  campaign  features  a  special  Year  2000  Internet  site,  www.hcfa.gov/Y2K, 
which  includes  some  of  the  basic  steps  that  can  be  taken  by  a  Medicare  provider  or  supplier,  such 
as: 

•  Preparing  an  inventory  of  hardware  and  software  programs  and  identifying  everything  that 
is  mission-critical  to  their  business  operations; 

•  Assessing  the  Year  2000  readiness  of  their  inventory  as  well  as  options  for  upgrading  or 
replacing  systems,  if  necessary; 
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•  Updating  or  replacing  systems  important  to  business  operations,  if  necessary: 

•  Testing  existing  and  newly  purchased  systems  and  software  and  their  interfaces;  and 

•  Developing  business  continuity  plans  for  unexpected  problems. 

Our  Internet  site  also  includes  links  to  other  essential  sites  for  providers,  such  as  the  Food  and 
Drug  Administration's  Internet  site  on  medical  device  compliance. 

We  have  developed  a  speakers'  bureau  with  staff  trained  to  make  presentations  and  answer 
questions  on  Year  2000  issues  around  the  country.  We  are  leading  the  Health  Care  Sector  of  the 
President  s  Council  on  Year  2000  Conversion,  which  includes  working  closely  with  provider 
trade  associations  and  public  sector  health  partners  to  raise  awareness  of  the  millennium  issue  and 
encourage  all  providers  to  become  compliant.  And  our  claims  processing  contractors  are  offering 
providers  Year  2000  compliant  electronic  billing  software  for  free  or  at  minimal  cost. 

I  was  pleased  that  some  provider  associations  have  recently  announced  their  intention  to  assess 
the  Year  2000  readiness  of  their  membership  and  to  step-up  educational  efforts  on  the  critical 
nature  of  this  problem.  This  is  an  essential  undertaking.  Quite  simply,  Year  2000  compliance 
cannot  be  a  one-way  street.  Providers  also  must  meet  this  challenge  head  on,  or  risk  not  being 
able  to  receive  prompt  payment  from  Medicare,  Medicaid,  or  virtually  any  other  insurer. 

We  welcome  Congress'  help  in  making  providers  aware  of  the  Year  2000  and  energizing  them  to 
address  their  part  of  the  problem.  I  invite  you  to  help  us  identify  opportunities  to  get  the  Year 
2000  message  across  and  encourage  you  to  stress  the  importance  of  this  issue  when  you  meet 
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with  providers.  As  I  mentioned  previously,  we  have  established  a  special  Year  2000  speakers' 
bureau  with  staff  around  the  country  prepared  to  speak  and  offer  guidance  You  may  want  to 
have  them  join  you  when  you  meet  with  providers,  and  let  others  know  that  they  are  av  ailable. 

States'  Progress 

Our  concern  for  States  is  as  great  as  our  concern  for  providers.  For  both,  we  do  not  have  the 
authority,  ability,  or  resources  to  step  in  and  fix  their  systems  for  them.  Our  ten  regional  offices 
are  monitoring  the  status  of  each  State's  remediation  effort.  We  also  have  an  expert  IV&V 
contractor,  TRW,  to  assist  us  in  conducting  on-site  visits  in  every  State  to  provide  advice  and 
validate  assessments.  This  allows  us  to  maintain  an  accurate  picture  of  each  State's  progress.  We 
have  already  done  on-site  visits  in  16  States  and  the  District  of  Columbia  and  expect  to  visit  the 
remaining  States  by  the  end  of  April.  The  preliminary  reports  confirm  earlier  work  by  the  GAO 
which  strongly  suggests  that  some  States  will  not  be  ready  on  time. 

We  have  asked  all  Medicaid  and  CHIP  Directors  to: 

►  Report  the  status  of  their  Year  2000  compliance  efforts; 

►  Document  contingency  plans  for  systems  that  may  not  be  compliant;  and 
*        Provide  updates  to  HCFA's  regional  offices  on  States'  progress. 

It  is  each  State's  responsibility  to  take  the  steps  it  believes  are  appropriate  to  meet  the  needs  of  its 
Medicaid  and  CHIP  beneficiaries.  Our  primary  role  is  to  assess,  as  best  we  can,  each  State's 
progress  and  to  provide  guidance.  While  we  do  not  have  the  authority,  ability,  or  resources  to  fix 
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State  systems,  we  can  and  do  want  to  help.  In  addition  to  furnishing  the  services  of  TRW.  we 
have  developed  technical  assistance  documents,  and  held  regional  meetings  and  workshops  for 
States  on  how  to  develop  contingency  plans.  We  know  that  States  and  Congress  share  our  goal 
of  protecting  all  our  beneficiaries  throughout  the  millennium  transition. 

Budgetary  Needs 

The  Year  2000  problem  is  not  static.  We  are  obligated  to  perform  rigorous  testing  because  of  the 
extent  of  our  reliance  on  information  systems.  Efforts  to  solve  one  element  of  the  problem  often 
uncover  other  problems.  This  makes  it  challenging  to  determine  our  budgetary  requirements.  As 
you  know,  we  previously  have  had  to  request  additional  funding  and  redirect  existing  funding  to 
meet  these  changing  demands. 

In  fiscal  year  1998,  we  received  $107. 1  million  in  funding  for  millennium  activities.  This  funding 
included  a  $15  million  appropriation;  an  additional  $30  million  that  was  transferred  from  other 
agency  projects;  $20  million  in  redesignated  funds  originally  appropriated  for  systems  transitions; 
and  $42. 1  million  made  available  by  the  Department  of  Health  and  Human  Services  (HHS) 
through  the  Secretary's  one  percent  transfer  authority.  Through  very  careful  financial 
management  and  a  keen  recognition  of  the  importance  of  the  Year  2000  effort,  we  actually 
obligated  approximately  $148  million  in  fiscal  year  1998  on  Year  2000  activities:  $130  million  on 
external  systems  and  $  1 8  million  on  internal  systems. 

Thanks  to  your  support  in  the  fiscal  year  1 999  appropriations  process  we  are  making  significant 
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progress  toward  obtaining  the  funding  needed  to  support  all  of  our  Year  2000  efforts.  We 
received  $82.5  million  in  our  appropriation  for  this  year.  The  Office  of  Management  and  Budget 
(OMB),  with  Congressional  concurrence,  transferred  an  additional  $205.1  million  from  the  Year 
2000  emergency  fund.  This  funding  provides  a  total  of  $287.6  million  to  support  our  Year  2000 
efforts  in  fiscal  year  1999.  We  plan  to  use  FY  1999,  as  well  as  FY  2000,  funding  to  increase  our 
contingency  planning  efforts  by  developing,  testing,  and  rehearsing  contingency  plans. 

The  President's  Budget  request  for  FY  2000  includes  an  additional  $150  million  for  our  Year 
2000  effort.  In  addition  to  funding  our  contingency  planning  efforts,  a  large  portion  of  this 
funding  will  support  outreach,  continuing  external  systems  remediation,  and  increases  in  billing 
and  communications  activities  at  our  contractors.  Increased  public  awareness  of  the  Year  2000 
and  concern  about  potential  problems,  coupled  with  possible  disruptions  in  claims  processing, 
may  increase  the  number  and  cost  of  paper  and  duplicate  claims,  the  level  of  inquiries  from 
beneficiaries  and  providers,  as  well  as  related  printing  and  postage  costs.  This  funding  will  help 
us  and  our  contractors  meet  these  anticipated  challenges. 

It  is  important  to  note  that  because  our  systems  are  highly  automated  and  the  majority  of  our 
processes  are  completed  electronically,  we  are  performing  far  more  rigorous  Year  2000  testing 
than  many  businesses.  Many  businesses  are  not  testing  their  systems  for  future  dates  and  they  will 
not  know  with  certainty  if  their  systems  will  operate  in  the  Year  2000.  HCFA  will.  Our  testing 
regimen  is  far  more  rigorous  than  the  industry  standard,  with  multiple  layers  of  testing,  including 
regression  testing,  testing  in  a  simulated  Year  2000  environment,  and  testing  our  entire  systems  in 
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an  actual  Year  2000  environment. 

In  addition  to  the  extensive  tests  performed  by  those  who  actually  maintain  the  system,  we  also 
are  requiring  independent  testing  of  our  most  critical  systems  and  additional  oversight  by  an 
IV&V  contractor.  This  coming  year  we  expect  to  perform  extensive  validation  and  recertification 
of  these  critical  systems  to  ensure  that  changes  made  during  1999  do  not  affect  our  Year  2000 
renovations.  Although  this  additional  testing  and  validation  significantly  increases  the  time 
required  for,  and  the  cost  of.  certifying  the  Medicare  systems,  we  know  that  we  simply  cannot 
afford  to  fail  and  are  doing  everything  within  our  power  to  ensure  that  we  do  not. 

Our  systems  are  not  only  complex  in  their  own  right,  they  also  require  extensive  data  exchanges 
with  more  than  one  million  partners,  such  as  providers,  banks,  and  vendors.  We  must  guarantee 
that  all  of  our  renovated  systems  work  with  all  of  these  partners.  And  so  we  must  conduct  data 
exchange  tests  with  the  provider  community  to  ensure  that  we  can  exchange  the  transactions 
required  for  electronic  commerce. 

Conclusion 

We  have  made  remarkable  progress  in  our  Year  2000  compliance  effort  and  have  taken  critical 
steps  to  ensure  that  all  of  our  systems  will  be  ready  for  the  new  millennium.  There  is  still  a  great 
deal  of  work  to  be  done,  but  we  now  feel  that  we  are  making  adequate  progress.  We  will 
continue  in  1999  to  work,  test  and  retest  our  systems.  But  I  must  reiterate  our  concern  with  the 
progress  of  some  States  and  providers  in  meeting  their  own  Year  2000  challenges.  We  are 
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committed  to  providing  all  the  assistance  we  can.  but  in  some  cases  that  may  not  be  enough.  We 
all  share  a  common  goal  of  guaranteeing  that  our  systems  and  programs  function  in  the  new 
millennium.  I  thank  you  for  your  attention  to  this  essential  issue,  and  I  am  happy  to  answer  any 
questions  you  may  have. 
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Mr.  Horn.  I  will  turn  to  Mr.  Callahan. 

Mr.  Callahan.  Thank  you,  Chairman  Horn,  Congressman  Turn- 
er, and  other  distinguished  members  of  the  subcommittee. 

I  am  pleased  to  appear  before  you  today  to  testify  about  the  De- 
partment's efforts  to  make  its  payment  management  system  Y2K 
compliant.  I  am  also  accompanied  today  by  Dr.  Neil  Stillman,  who 
is  the  Deputy  CIO  of  the  Department,  and  Jeanette  Clay,  who  is 
the  Chief  Information  Officer  for  the  Program  Support  Center. 

I  would  like  to  echo  Nancy-Ann  DeParle's  statement  about  the 
committee.  Clearly  sometimes  even  though  these  sessions  may  ap- 
pear to  be  a  bit  painful,  clearly  when  we  reach  January  1,  2000 
and  we  succeed,  in  no  small  measure  a  good  deal  of  the  credit  will 
go  to  you  personally  and  to  the  members  of  your  committee  for  ask- 
ing us  to  be  as  diligent  as  we  can  be  on  the  Y2K  effort. 

The  payment  management  system,  which  is  the  subject  of  the 
hearing  today,  is  run  by  the  Program  Support  Center  of  the  De- 
partment, not  by  HCFA;  it  is  run  by  the  Program  Support  Center. 
This  serves  20,000  grantees  across  the  Nation  and  it  is  a  histori- 
cally sound  and  successful  grants  payment  system.  Indeed,  in  its 
more  than  30  years  of  operation,  it  has  only  been  down  for  one-half 
day  during  the  blizzard  of  1996. 

I  will  say  this,  since  not  many  people  know  about  the  payment 
management  system.  It  serves  20,000  grantees.  It  makes  260,000 
payments  a  year  or  about  1,000  payments  a  day.  $165  billion  a 
year  goes  through  that  system,  and  what  happens  in  this  system 
is  States,  for  example,  with  regard  to  their  grants  which  go 
through  the  system,  draw  down  grants  daily  and  most  of  the  other 
grantees  draw  down  their  grant  allocations  every  2  weeks.  In  es- 
sence, it  is  a  just  in  time  grant  payment  system.  This  system,  as 
it  currently  operates,  saves  the  Federal  Government  $60  million  a 
year  as  a  result  of  adhering  to  the  Cash  Management  Improvement 
Act. 

But  as  with  any  businesslike  process,  the  Department  of  Health 
and  Human  Services  is  committed  to  making  continuous  improve- 
ments in  the  payment  management  system.  That  is  why  we  en- 
gaged beginning  in  1994  in  the  process  of  developing  as  a  business 
solution  the  fourth  major  system  development  of  this  system  since 
its  inception  in  1969,  Yet  in  this  particular  case  of  reengineering, 
obviously  we  have  to  be  fully  cognizant  of  the  need  to  make  a  new 
payments  management  system  Y2K  compliant. 

Therefore,  in  November  1998  we  followed  a  parallel  track  of  re- 
mediating the  older  legacy  code,  the  current  payment  management 
system,  to  be  year  2000  compliant  as  a  contingency  while  at  the 
same  time  continuing  on  a  business  solution  to  develop  a  fourth 
generation  rebuild  of  the  payment  management  system. 

Obviously  given  the  decision  at  that  time  to  look  into  following 
a  dual  track,  we  obtained  the  expert  advice  of  the  Avistar  Corp.  to 
assess  the  risk  of  completing  the  new  system  development,  the 
fourth  system  rebuild  of  testing,  the  testing  and  implementation  of 
the  current  system,  the  remediation  of  the  legacy  code  with  an  eye 
toward  achieving  a  low  risk  Y2K  compliant  payment  management 
product  in  the  shortest  possible  time.  The  report  has  been  delivered 
to  us  by  the  Avistar  Corp.  this  week.  We  will  provide  this  to  the 
committee  in  its  entirety. 
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Based  on  that  recent  report  that  we  have  received  from  the 
Avistar  Corp.,  we  plan  to  proceed  immediately  with  the  testing  and 
implementation  of  the  renovated  legacy  based  payment  manage- 
ment system.  We  expect  this  system  to  be  Y2K  compliant;  that  is, 
renovated,  remediated,  tested  and  implemented  by  June  1999. 

At  the  same  time,  and  this  again  comes  from  the  recommenda- 
tion of  the  Avistar  report,  outside  of  this  development  effort,  and 
not  to  complicate  this  decision,  we  will  devote  additional  staff  and 
resources  to  achieve  the  goal  of  having  in  place  hopefully  before  the 
end  of  the  calendar  year  a  fourth  generation  Y2K  reengineered 
PMS  system.  But  I  will  emphasize  to  the  committee  we  will  not  fol- 
low that  second  track  and  in  any  way  that  would  jeopardize  getting 
at  the  fastest  possible  date  a  Y2K  compliant  payment  management 
system. 

We  would  hope  to  achieve  obviously  the  best  possible  outcome  of 
having  two  Y2K  compliant  payment  management  systems  that 
could  be  available  for  operation  in  the  year  2000  and  at  some  point 
when  we  have  a  fully  operational  Y2K  reengineered  payment  man- 
agement system,  we  will  operate  that  in  place  of  the  current  sys- 
tem. 

With  regard  to  contingency  planning,  the  Program  Support  Cen- 
ter, as  is  the  case  with  all  of  our  agencies,  including  HCFA,  have 
supplied — at  least  I  think  most  of  them  are  up  to  their  second 
drafts  of  their  business  continuity  in  their  contingency  plans,  and 
we  will  be  testing  and  implementing  those  contingency  plans 
throughout  the  year.  We  believe  that  the  contingency  plan  that  is 
put  forward  to  us  is  imminently  practicable  on  the  part  of  the  Pro- 
gram Support  Center  and  that  the  plans  will  ensure  that  the 
20,000  grantees  that  we  now  service  across  the  government,  includ- 
ing HHS,  will  receive  the  Federal  funds  that  they  are  due  for  their 
prior  year  and  fiscal  year  2000  appropriations. 

We  pledge  to  you  on  behalf  of  the  Secretary,  the  Deputy  Sec- 
retary and  myself  and  the  Program  Support  Center  that  our  cus- 
tomers, our  grant  customers,  will  be  paid  in  full  and  on  time.  You 
have  our  word  on  that. 

Thank  you,  and  I  would  be  happy  to  answer  any  questions  that 
you  may  wish  to  pose  to  me. 

[The  prepared  statement  of  Mr.  Callahan  follows:] 
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INTRODUCTION 

Good  morning.  I  am  John  Callahan,  Assistant  Secretary  of  the  Department  of  Health  and 
Human  Services  for  Management  and  Budget  (ASMB)  and  Chief  Information  Officer 
(CIO).  I  am  pleased  to  appear  before  this  Subcommittee  to  provide  you  with  a  report  on 
the  accomplishments  and  the  challenges  faced  by  the  Department  of  Health  and  Human 
Services  (HHS)  in  assuring  that  our  systems  are  Millennium  compliant.  I  offer  my 
comments  on  behalf  of  the  Department  and  the  Program  Support  Center  (PSC). 

The  Secretary,  the  Deputy  Secretary,  and  I  have  declared  the  Year  2000  date  issue  to  be 
our  highest  information  technology  priority.  We  have  taken  and  will  continue  to  take 
strong  actions  to  ensure  that  HHS  information  systems  are  Year  2000  compliant 

We  have  involved  all  parts  of  our  organization,  including  staff  with  expertise  in 
information  systems,  budget,  human  resources,  and  acquisition  management  in  solving 
the  Year  2000  problem.  No  matter  what  else  we  do  and  what  other  initiatives  we 
undertake,  we  must  ensure  that  our  ability  to  accomplish  the  Department's  mission  is  not 
impaired  by  the  Y2K  problem. 

For  this  reason,  we  established  December  31, 1998  as  our  internal  deadline  for  Year  2000 
compliance  of  mission  critical  systems  intentionally  setting  it  3  months  ahead  of  the 
official  government-wide  deadline  of  March  31, 1999.  This  was  done  in  order  to  provide 
a  full  year  of  operations  in  which  to  detect  and  remedy  any  adverse  interactions  among 
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HHS  systems  and  those  of  our  many  service  partners,  including  other  Federal  agencies, 
states  and  local  governments,  tribes,  and  contractors.  As  of  January  31,  1999,  most  of  our 
mission  critical  systems  were  Y2K  compliant. 


HHS's  YEAR  2000  EFFORT 


To  meet  our  Year  2000  responsibilities,  we  have  taken  a  series  of  strong  administrative 
actions.  We  have  encouraged  aggressive  reallocation  of  funds,  where  necessary,  to  meet 
Year  2000  deadlines;  we  have  established  direct  reporting  lines  between  staff  working  on 
year  2000  activities  and  the  Operating  Division  (OPDIV)  Chief  Information  Officers. 
Each  OPDIV  CIO  is  responsible  for  regular  reporting  on  Year  2000  efforts  directly  to  the 
OPDIV  head  and  the  Department's  Chief  Information  Officer  until  Year  2000  date 
compliance  is  achieved. 

HHS  has  also  taken  action  to  retain,  re-employ,  and  attract  qualified  information 
technology  professionals,  using  both  employment  and  contracting  authorities.  On 
March  31, 1998,  HHS  received  Department- wide  personnel  authorities  from  the  Office  of 
Personnel  Management  (OPM)  to  waive  the  pay  and  retirement  reduction  for 
re-employed  military  and  civilian  retirees  who  return  to  work  on  Y2K  remediation.  To 
date,  the  Health  Care  Financing  Administration  has  used  the  waiver  authority  to  reemploy 
forty-one  annuitants  and  the  Program  Support  Center  has  hired  one  annuitant. 
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HHS  agencies  collect  a  tremendous  amount  of  information  that  requires  data  exchanges. 
The  Department  has  inventoried  our  data  exchanges  and  contacted  our  serv  ice  partners  to 
emphasize  the  importance  of  assuring  Year  2000  compliance.  HHS  is  working  with  the 
National  Association  of  State  Information  Resource  Executives  (NASIRE)  and  others  to 
assure  a  coordinated  response.  On  April  22,  1998,  HHS  provided  a  listing  of  State 
interfaces  to  NASIRE  for  its  review  of  completeness  and  accuracy,  and  we  will  update 
this  listing  monthly  until  all  of  our  State  interfaces  are  compliant  HHS  continues  to 
update  the  listing  on  the  GSA  web  site  for  NASIRE  review.  In  addition  to  data 
exchanges  with  States,  HHS  systems  also  exchange  data  with  other  federal  agencies,  local 
governments,  Medicare  contractors  and  fiscal  intermediaries,  private  insurance 
companies,  universities,  banks,  and  drug  manufacturers. 

In  addition,  HHS  is  requiring  all  of  its  operating  divisions  to  conduct  thorough  testing 
and  independent  verification  and  validation  of  its  renovated  systems.  We  aiso  know  there 
is  a  possibility  that,  try  as  we  might,  some  systems  may  not  be  fully  compliant  in  time. 
Consequently,  all  of  our  Operating  Divisions  have  submitted  initial  business  continuity 
and  contingency  plans  to  the  Department  These  plans  will  be  finalized  and  tested 
throughout  1 999  to  provide  us  with  the  operational  policies  needed  to  permit  business 
continuity  in  the  event  of  system  failure. 
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THE  PAYMENT  MANAGEMENT  SYSTEM  BACKGROUND 

The  Division  of  Payment  Management  (DPM),  of  the  Program  Support  Center  (PSC), 
operates  the  Payment  Management  System  (PMS)  which  provides  centralized  electronic 
funding  and  cash  management  service  to  all  organizations  receiving  HHS  grants.  Besides 
making  automated  payments,  DPM  monitors  funds  in  the  hands  of  recipients,  provides 
debt  management  services  such  as  debt  collection  and  serves  as  a  customer  service 
intermediary  between  grant  recipients  and  grant  awarding  agencies. 

The  Payment  Management  System  (PMS)  is  a  historically  sound  and  successful  system 
that  provides  grant  payment  services  which  include  the  expeditious  flow  of  cash  and 
corresponding  disbursement  data  between  awarding  agencies  and  grant  recipients.  HHS 
has  over  30  years  experience  in  paying  grants  on  a  centralized/consolidated  basis  and  in 
developing  and  maintaining  systems  to  support  this  function.  In  the  1960s  NIH 
centralized  its  payments  for  all  of  its  grant.  In  1975  the  operation  was  transferred  to  the 
Office  of  the  Secretary  and  began  paying  grants  for  all  the  components  of  HHS,  and  in 
the  1989  HHS  began  paying  grants  for  other  Federal  agencies.  This  operation  has  proven 
extremely  reliable,  efficient  and  cost  effective,  realizing  significant  savings  due  to 
economies  of  scale.  Indeed,  it  was  down  only  one  half  day  in  recent  history  due  to  a 
blizzard  during  1996. 
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HHS  is  now  a  recognized  leader  in  the  providing  funds  to  recipients  of  federal  grants  on  a 
just-in-time  basis.  The  PMS  supports  organizations  funded  by  ten  other  federal  agencies 
and  42  different  subagencies.  In  FY  1998  the  system  made  260,000  payments  totaling 
$165  billion  to  20,000  grantees.  The  PMS  can  receive  automated  or  manual  payment 
requests,  edit  them  for  accuracy  and  content,  batch  them  for  forwarding  to  the  Federal 
Reserve  Bank  for  payment,  and  record  the  transaction  to  the  appropriate  general  ledger 
accounts. 

The  current  Payment  Management  System  was  implemented  in  1984.  Major 
enhancements  have  been  implemented,  such  as  providing  the  capability  for  grantees  to 
request  funds  and  obtain  information  about  their  account  balances  electronically  via  their 
PC,  and  allowing  the  grantees  to  report  expenditures  electronically,  thereby  reducing  the 
administrative  burden  on  the  grantees.  Being  committed  to  good  business  practices  and 
to  improving  and  reengineering  our  systems  to  provide  better  customer  service,  in  1994 
we  initiated  a  business  review  of  the  PMS  Legacy  system  resulting  in  a  recommendation 
for  a  major  reengineeiing  effort  to  modernize  the  PMS.  This  system  development  effort, 
the  fourth  major  PMS  redesign  in  30  years,  was  identified  as  mission  critical  for  Y2K 
compliance  purposes. 

The  actual  programming  of  the  re-engineered  PMS  began  in  January  of  1998,  with  a 
planned  operational  date  of  December  1998.  As  work  progressed,  DPM  management 
became  concerned  about  potential  slippage  in  the  schedule.  Therefore,  in  order  to  ensure 
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Y2K  compliance,  we  began  to  remediate  the  Legacy  system  code  of  the  existing  PMS. 
We,  therefore,  proceeded  on  a  parallel  track,  remediating  the  legacy  code  while 
continuing  to  develop  the  new  PMS. 

Y2K  ASSESSMENT  OF  THE  PAYMENT  MANAGEMENT  SYSTEM 

My  office  in  conjunction  with  PSC  initiated  expedited  Y2K  compliance  assessment 
activity  to  review  PMS  alternatives  against  the  government-wide  March  31  Y2K 
compliance  deadlines  imposed  by  OMB.  To  accomplish  this,  we  sought  expert  outside 
advice  to  assess  the  risk  and  schedule  for  completing  development  of  the  new  PMS 
versus  testing  and  implementing  the  legacy  remediated  code. 

The  PMS  is  undergoing  a  major  re-engineering;  major  development  deliveries  have  been 
completed;  and  testing  and  Y2K  certification  activities  are  still  pending.  The  Re- 
engineered  PMS  introduces  additional  functionality  not  available  with  the  Legacy  PMS, 
in  particular  a  Web-based  interface  and  improved  tracking  and  reporting  features.  The 
Legacy  PMS  has  been  Y2K  renovated,  but  has  not  yet  been  validated  or  IV&V  certified. 

Currently,  based  on  the  findings  of  an  independent  study  neither  the  Legacy  nor  the  Re- 
engineered  PMS  can  be  certified  as  Y2K  compliant  by  March  31, 1999.  Our  lowest  risk 
alternative  is  recommended  as  priority  testing  and  implementation  of  the  remediated 
Legacy  system.  Our  secondary  initiative  will  be  to  continue  development  of  the  new 
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generation  PMS  with  the  goal  of  its  implementation  prior  to  January  1 ,  2000.  This 
strategy  is  now  being  implemented  by  the  PSC.  This  decision  has  the  full  backing  of  the 
PSC  leadership,  me,  Deputy  Secretary  Kevin  Thurm,  and  Secretary  Donna  Shalala. 

We  will  report  back  to  the  Committee  monthly  on  the  status  of  our  PMS  Y2K  testing  and 
IV&V  certification  efforts.  It  is  our  expectation  that  we  will  have  the  Legacy  system 
validated  and  implemented  by  June  1999.  We  would  further  hope  to  have  a  compliant 
version  of  the  newly  developed  PMS  prior  to  year's  end. 

This  Department  believes  we  have  thoroughly  analyzed  and  evaluated  the  options  for 
Y2K  compliance  of  PMS,  and  we  have  chosen  the  lowest  risk  alternative,  a  remediated 
Legacy  system  that  will  yield  rapid  PMS  Y2K  compliance. 

BUSINESS  CONTINUITY  AND  CONTINGENCY  AND  DAY  1  PLANNING 

The  PSC  has  also  developed  a  business  continuity  and  contingency  plan  for  the  critical 
processes  of  PMS.  This  plan  documents  action  items  required  should  there  be  a  Y2K 
problem  and  provides  for  testing  of  the  contingency  actions.  This  document  will  be 
shared  with  our  federal  customers.  We  have  been  using  the  PSC  quarterly  technical 
bulletin  (Quickdraw)  to  keep  our  20,000  recipients  informed  on  Y2K  issues  and  are  fully 
prepared  to  make  payments  to  our  recipients  on  time  when  the  year  2000  arrives. 
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Although  we  are  confident  that  our  efforts  to  ensure  that  PMS  is  Y2K  compliant  and  that 
transactions  across  the  end-to-end  business  process  will  be  successfully  executed  at  the 
century  roll-over,  we  have  also  developed  plans  to  ensure  business  continuity  in  the  event 
of  an  unforeseen  system  failure.  The  end-to-end  process  includes  a  number  of  critical 
resources  in  addition  to  the  Payment  Management  System.  The  other  key  components 
include:  the  systems  at  the  grant-awarding  agencies  which  transmit  data  on  new  awards 
or  modifications  to  awards  that  are  the  input  to  PMS;  the  NIH/CIT  Data  Center  on  which 
the  PMS  software  runs;  and  the  Federal  Reserve  systems  that  provide  for  payments  into 
the  commercial  banking  systems. 

The  Business  Continuity  Plan  developed  by  the  PSC's  Financial  Management  Service 
(PSC/FMS)  provides  for  a  back-up  process  in  the  event  of  a  failure  in  any  of  these  critical 
resources.  Should  the  granting  agencies'  input  systems  be  affected,  or  if  the  agencies  are 
unable  to  transmit  electronically,  PSC/FMS  will  receive  data  on  paper  forms  received  via 
fax  (if  operational)  or  mail  or  courier  service.  Normal  in-transit  authorization  procedures 
would  then  be  followed.  Grant  recipients  may  also  request  payments  using  phone,  fax,  or 
courier.  Data  will  be  maintained  by  PSC/FMS  on  a  backup  system  using  stand-alone 
compliant  PC's.  Should  a  problem  occur  with  the  Data  Center,  an  alternative  back-up 
processing  site  would  be  available  through  the  contingency  plan  for  NIH/CIT.  If  a 
problem  occurs  in  the  transmission  of  transactions  to  the  Federal  Reserve,  PSC/FMS  will 
take  advantage  of  redundancy  in  the  processing  path  for  PMS  transactions.  Alternative 
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Federal  Reserve  processing  locations  have  been  established,  and  the  contingency 
procedures  as  established  by  those  organizations  will  be  followed  to  ensure  that 
transactions  can  be  completed.  Finally,  in  the  event  that  a  Y2K  problem  prevents 
PSC/FMS  staff  to  gain  access  to  their  workplace  to  conduct  business,  plans  and 
procedures  have  been  developed  for  staff  to  be  able  to  continue  to  work  from  home  or 
from  an  alternate  site. 

In  preparation  for  operation  at  the  century  roll-over,  PSC/FMS,  as  part  of  an  overall 
HHS-wide  effort,  is  also  developing  a  Day  One  strategy.  The  organization  will  have  key 
process  and  systems  staff  on  site  on  the  week  preceding  and  following  January  1  to 
ensure  systems  and  processes  are  functioning  properly,  and  to  expedite  the 
implementation  of  any  needed  business  continuity  measures  or  system  contingency  plans. 

CONCLUSION 

HHS  still  faces  substantial  challenges  in  its  Year  2000  efforts.  However,  let  me  assure 
you,  on  behalf  of  Secretary  Shalala  and  Deputy  Secretary  Kevin  Thurm,  that  we  will 
continue  to  vigorously  pursue  Year  2000  remediation  as  our  most  important  initiative. 
The  Department  of  Health  and  Human  Services  intends  to  meet  its  responsibility  to  insure 
that  our  Payment  Management  System  which  now  serves  some  20,000  grantees  in  a 
number  of  Federal  agencies  is  Year  2000  compliant.  There  will  be  no  cash  flow 
problems  for  our  customers  due  to  Y2K  problems.  Our  customers  will  be  paid  in  full  and 
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on  time. 


We  recognize  our  obligation  to  the  American  people  to  assure  that  HHS's  programs 
function  properly  now  and  in  the  next  millennium. 

I  thank  the  Committee  for  its  interest  and  oversight  on  this  issue,  and  I  would  be  happy  to 
answer  any  questions  you  may  have. 


10 
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Mr.  Horn.  Thank  you.  We  are  going  to  ask  Mr.  Willemssen  to 
rejoin  the  panel.  And  we  will  begin  the  questioning,  and  the  Gen- 
eral Accounting  Office  is  free  to  comment  on  all  the  questions  and 
answers  as  we  go  through  this.  We  appreciate  the  testimony  both 
of  you  have  given.  It  clears  up  some  of  the  matters. 

Let  me  start  the  questioning,  if  I  might,  and  yield  myself  5  min- 
utes of  time  here.  First,  I  would  like  to  ask  the  Administrator,  in 
your  testimony  you  state  that  17  of  the  54  compliant  systems  are 
highly  compliant  and  the  other  34  require  a  moderate  level  of  effort 
to  resolve  any  remaining  issues.  Is  that  correct? 

Ms.  DeParle.  Yes,  sir,  that's  based  on  our  IV&V  contractor's  as- 
sessment. And  then  yesterday  our  staff  on  the  government  manage- 
ment group  personally  met  with  your  staff. 

Mr.  HORN.  Now,  your  staff  stated  yesterday  that  all  54  compliant 
systems  required  only  minimal  effort  to  complete  the  remaining 
issues.  And  I  guess  the  question  is,  what's  the  definition  of  compli- 
ant? How  do  we  know  when  we  are  complete  here?  What  kind  of 
testing  has  gone  on? 

Ms.  DeParle.  Well,  what  we  mean  when  we  talk  about  compli- 
ance is  that  all  mission  critical — I  guess  it  has  four  steps,  all  mis- 
sion critical,  local  source  code,  software  and  hardware  used  to  sup- 
port the  system  were  renovated  and  Y2K  compliant.  Second,  that 
the  individual  contractor  had  completed  unit  testing,  integrated 
testing,  system  testing  and  end-to-end  testing  on  the  front  ends 
and  the  snared  system  software  interfaces. 

Third,  that  the  entire  system  had  been  future  date  tested  using 
a  combination  of  future  dates  simulation  and  in  a  separate  future 
date  tested  environment.  That's  the  so-called  hard  IPL.  And  they 
have  to  have  completed  and  reviewed  output  from  claims  cycles 
during  hard  IPLs  for  at  least  two  future  dates  for  the  recertifi- 
cation  in  July.  We  are  going  to  require  them  to  test  more  future 
dates,  but  for  this  initial  certification  it  was  just  two. 

In  fact,  Mr.  Chairman,  there  were  a  couple  who  turned  in  certifi- 
cations to  us,  and  when  we  checked  on-site  they  hadn't  done  those 
tests,  so  we  took  them  out. 

And,  finally,  they  have  to  ensure  that  all  mission  critical  busi- 
ness functions  would  be  Y2K  compliant  by  verifying  and,  where  ap- 
propriate, testing  the  readiness  of  all  mission  critical  hardware, 
software,  commercial  off-the-shelf  software  facilities  and  vendors 
used  to  support  such  functions. 

And  that  last  area  is  one  area  I  would  like  to  just  point  to,  be- 
cause one  of  the  differences  between  us  and  GAO  is  that  there  are 
some  contractors  who  had  some  COTS  software,  commercial  off- 
the-shelf  software,  that  was  not  tested  and  was  not  Y2K  compliant. 
But  in  their  qualifications  to  me,  which  I  held  up  a  while  ago  what 
we  had  sent  to  the  committee,  the  contractor  identified  that.  And 
we  checked  it  to  see  whether  or  not  it  was  mission  critical;  and  if 
it  wasn't  we  went  ahead  and  accepted  their  certification. 

Now,  by  this  July,  when  all  of  that  other  testing  is  done,  every- 
thing is  going  to  have  to  work,  no  ifs,  ands  or  buts.  But  we  felt  that 
was  a  minor  qualification  at  this  point.  And  I  think— Mr. 
Willemssen  and  I  have  discussed  this,  and  I  think  from  the  GAO's 
perspective,  they  think  all  that  should  have  been  done  in  Decem- 
ber. So  I  think  that's  the  issue. 


88 


Mr.  Horn.  Well,  on  that  very  point,  you've  given  a  definition  of 
compliant  and  the  Office  of  Management  and  Budget  on  behalf  of 
the  President  also  has  a  definition,  and  the  General  Accounting  Of- 
fice has  a  definition.  And  I  guess  I  would  ask,  Mr.  Willemssen,  as 
you  listen  to  this  discussion,  are  they  compliant  in  terms  of  OMB 
standards  and  GAO  standards? 

Mr.  Willemssen.  Well,  what  HHS  has  put  in  their  report,  the 
quarterly  report  to  OMB,  is  that  they  would  provide  a  description 
of  the  progress  on  their  systems  being  consistent  with  the  CIO 
counsel's  best  practices  guide  and  GAO's  assessment  guide.  So  from 
a  criteria  perspective,  given  that  statement,  we  used  our  guide  as 
a  measure  of  whether  those  systems  were  compliant. 

The  Administrator  is  correct,  much  of  that  computer  date  testing 
was  done.  Having  it  done  and  then  resolving  the  problems  result- 
ing from  that  testing  are  two  different  matters.  We  expect  the  reso- 
lution of  problems  emanating  from  testing  to  also  be  done  prior  to 
deeming  a  system  compliant.  In  many  cases  that  has  not  yet  been 
done. 

And  I  will  again  repeat,  if  these  issues  were  considered  minor  as 
of  December  31st,  then  one  would  expect  2  months  later,  February 
26th,  that  those  issues  would  have  been  resolved.  We  haven't  seen 
evidence  that  they  have  been  resolved  and  tested  so  that  those  sys- 
tems can  be  deemed  compliant  at  this  point  in  time. 

Mr.  Horn.  Well,  let  me  ask  the  Administrator.  Are  you  aware  of 
the  lag  there,  despite  the  fact  that  those  look  like  minor  bits  of  the 
glitch  and  not  major? 

Ms.  DeParle.  Yes,  sir,  I  am.  And  in  fact,  Mr.  Willemssen  and 
his  colleagues  spent  a  couple  of  hours  with  us  on  Monday  going 
through  all  of  this  to  make  sure  we  understood  it,  and  on  those 
specific  examples  that  he  cites,  I  don't  know  if  it's  in  this  testi- 
mony, but  it's  one  that  he  discussed.  The  Florida  shared  system, 
which  is  one  of  our  biggest  systems,  there  were  a  couple  of  issues 
in  their  report  that  in  fact  they  have  corrected — they  corrected  as 
of  January  29th.  Those  were  qualifications  that  they  identified  to 
us  and  then  they  corrected  and  we  do  have  evidence  of  that.  So, 
I  asked  Dr.  Christoph  about  this  yesterday  ?  just  to  be  sure,  and  he 
advises  me  that  these  things  have  been  corrected. 

Mr.  Horn.  Thank  you.  Since  we  have  a  visiting  Subcommittee  on 
Technology,  I'm  going  to  yield  to  the  chair  of  that  subcommittee, 
and  then  to  Mr.  Turner  on  our  committee  and  then  to  Mr.  Gordon 
on  that  committee.  So  the  gentlewoman  from  Maryland,  who  is 
chairman  of  the  Subcommittee  on  Technology. 

Mrs.  Morella.  Thank  you.  Thank  you,  Mr.  Chairman.  The  ques- 
tion I  want  to  ask  has  to  do  with  personnel,  since  so  much  of  Y2K 
compliance  relies  on  people.  I  mean  it's  so  intensive  in  terms  of 
labor.  And  since  there  are  really  so  few  who  may  know  COBOL  and 
may  know  that  system,  et  cetera,  could  you  give  me  a  candid  analy- 
sis of  how  personnel  fits  into  the  compliance  strategy?  And  I'm  ask- 
ing you,  do  you  have  trouble  with  recruiting  people? 

Have  you  had  to  rely  more  than  you've  ever  thought  on  contrac- 
tors and  subcontractors  because  of  that?  Are  you  losing  some  peo- 
ple who  may  have  seniority  or  expertise?  I  know  this  is  a  tough 
question  with  many  implications,  but  I  would  really  like  your  can- 
did assessment  of  it. 
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Mr.  Callahan.  Congresswoman  Morella,  let  me  make  a  brief 
comment  and  defer  to  HCFA  Administrator  DeParle.  You're  abso- 
lutely correct  that  the  human  resource  dimension  is  the  critical  ele- 
ment of  getting  this  Y2K  compliant  problem  solved.  It  is  a  difficult 
problem.  Certainly  the  people  that  are  working  on  it  in  the  agen- 
cies, whether  that  be  at  HCFA  or  Program  Support  Center,  support 
and  deserve  our  commendation  for  the  long  hours  that  they  are 
putting  in  and  the  efforts  they  are  making. 

The  Department  of  Health  and  Human  Services  was  the  first 
agency  to  go  to  the  Office  of  Personnel  Management  and  ask  for  an 
amendment  to  the  law  to  rehire  annuitants  that  were  familiar  with 
the  Y2K  problem  that  had  worked  at  these  agencies  and  could 
come  back  and  help  us  in  this  effort  without  losing  their  annuity. 
As  you  know,  given  your  experience,  if  you  rehire  they — we've  hired 
approximately  54  reemployed  annuitants.  HCFA  has  taken  the 
lead.  I  think  they  have  over  50  of  those,  and  the  Program  Support 
Center  has  brought  back  a  person. 

So  we  took  the  initiative  as  a  department  to  go  out  and  seek 
those  qualified  employees  to  come  back  and  help  us,  and  they  have. 

Ms.  DeParle.  I  would  say,  though,  just  to  add  a  little  bit  to  this, 
from  speaking  to  our  contractors  around  the  country,  the  60  con- 
tractors who  operate  these  78  systems  that  we've  been  talking 
about  this  morning,  they  have  had  difficulty  as  well  in  hiring  and 
retaining  the  kind  of  personnel  that  is  needed. 

And  it  is  something  that  I  think  as  we  get  closer  and  closer  to 
the  deadline,  one  of  the  concerns  I  have  when  we  talk  about  what 
the  challenges  are  out  there,  not  even  just  for  our  contractors,  be- 
cause they've  known  about  this  for  a  year,  and  they've  been  work- 
ing, but  for  some  of  the  providers  like  the  ones  Congressman  Turn- 
er talked  about,  if  they  haven't  already  started,  they're  going  to 
have  trouble  finding  people  who  can  do  this  work.  And  that's  some- 
thing I've  been  concerned  about. 

Mrs.  Morella.  Have  you  been  losing  people  because  of  the  lure 
of  higher  salaries  in  the  private  sector? 

Ms.  DeParle.  Hardly  a  week  goes  by  that  I  don't  have  one  of  my 
senior  people  in  the  information  services  area  approached,  and  I 
suspect  Mr.  Willemssen  has  the  same  experience,  because  they  do 
have  such  valuable  expertise.  We  have  been  lucky  in  that  our  folks 
feel  very  committed  to  this  project  and  seeing  it  through  and  are 
patriotic  about  it,  I  think. 

Mrs.  Morella.  Has  any  of  the  work  been  sent  offshore? 

Ms.  DeParle.  Well,  HCFA  has  a  long  history  of  public/private 
partnerships  from  the  inception  of  the  Medicare  program.  For  34 
years,  we  have  worked  through  contractors.  There  are  only  4,000 
people  working  in  Baltimore,  there  are  25,000  people  working  at 
these  contractors.  So  we've  always  had  an  imbalance,  if  you  will, 
with  most  of  our  work  in  this  area  really  being  done  offsite. 

So,  we  were  already  using  contractors,  and  I  think  as  Mr. 
Willemssen  pointed  out,  there's  a  sense,  on  this  particular  project, 
that  contractors  are  helpful,  because  they  can  come  in  and  look 
over  your  shoulder,  and  that's  what  the  IV&V  contractor,  that  GAO 
advised  us  to  get,  has  been  doing. 

Mrs.  MORELLA.  Is  there  anything  we  can  do  to  help  with  regard 
to  contractors? 
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Ms.  DeParle.  Yes. 

Mrs.  Morella.  I  would  imagine  the  data  exchange  law  that 
passed  would  have  been  of  some  assistance  in  terms  of  freeing  up 
some  of  the  chilling  effect  of  just  sharing  information? 

Ms.  DeParle.  I  think  it  helped.  And  as  I  mentioned  before,  one 
of  the  first  things  I  did  was  ask  contractors  to  sign  an  amendment 
to  their  contract  requiring  them  to  be  compliant.  And  I  was 
rebuffed  pretty  strongly  for  about  6  months.  And  then  after  Con- 
gress passed  the  law,  they  became  more  willing  to  do  it.  Because 
one  of  their  concerns  had  been  what  if  the  power  systems  fail  or 
what  if  things  beyond  our  control  failed,  and  you  helped  with  that. 

I  should  note,  too,  Congresswoman,  you  asked  me  about  work  off- 
shore, and  we  don't  have  anyone  working  offshore. 

Mrs.  Morella.  No,  the  contractors  may  and  do,  whatever,  but 
you  don't. 

Mr.  Willemssen,  would  you  like  to  comment  on  that  whole  con- 
cept of  personnel? 

Mr.  Willemssen.  A  couple  points  I  will  make.  First  is  to  echo 
what  Dr.  Callahan  said  is  one  of  the  best  things  that  the  executive 
branch  did  was  OPM  allowing  retired  retirees  to  come  back  without 
a  reduction  in  their  annuity.  That's  something  we  have  supported 
for  some  time.  That  was  an  excellent  move.  Many  agencies,  includ- 
ing HHS,  have  taken  advantage  of  that.  Second,  in  a  report  we  did 
last  year  in  the  personnel  area,  we  did  see  quite  a  bit  of  anecdotal 
evidence  throughout  the  government  that,  indeed,  there  were  peo- 
ple leaving  for  higher  salaries. 

There  wasn't  any  systemic  analysis  done,  but  clearly  it  was  an 
issue  that  was  coming  up.  Third,  as  we  move  into  1999  the  issue 
will  become  less  about  finding  people  who  can  fix  the  code,  so  to 
speak,  and  more  about  people  who  have  an  excellent  understanding 
of  end-to-end  testing  and  contingency  planning,  and  I  think  those 
kinds  of  resources  will  increasingly  be  in  short  supply. 

Mrs.  Morella.  I  want  to  thank  you  all  and  thank  you  for  work- 
ing together.  I  think  this  is  critically  important,  and  I  hope  that 
you  will  continue  to  see  us  as  an  important  part  of  working  to- 
gether with  you.  Thank  you. 

Thank  you,  Mr.  Chairman. 

Mr.  HORN.  I  thank  the  gentlewoman,  and  I  now  yield  to  the 
ranking  member  on  the  Government  Management,  Information, 
and  Technology  Subcommittee,  Mr.  Turner  of  Texas. 

Mr.  Turner.  Thank  you,  Mr.  Chairman.  Administrator  DeParle, 
I  want  to  ask  you  first  to  kind  of  go  back  with  me  a  little  bit.  I 
know  that  much  of  the  work  that  you've  done  trying  to  become  Y2K 
compliant  has  been  very,  very  costly. 

From  your  perspective,  has  the  agency  been  provided  sufficient 
funds  to  put  you  in  the  position  to  be  Y2K  compliant? 

Ms.  DeParle.  Yes,  sir.  And  I  want  to  thank  the  members  of  the 
committee  who  have  supported  us  and  the  Secretary,  last  year 
when  we  realized  after  getting  the  IV&V  contractor  that  we  had  50 
million  lines  of  code  to  renovate,  instead  of  what  they  originally 
thought,  which  was  20  million.  We  needed  some  money  fast.  And 
the  Secretary  did  something  that  was  very  difficult.  She  basically 
tapped  funding  from  other  agencies  in  the  Department  to  come  up 
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with  $40  million,  so  that  we  could  have  right  then  and  go  ahead 
and  get  the  contractors  to  hire  people  to  do  this  work. 

It  would  have  been  harder  if  we  had  had  to  wait  for  the  emer- 
gency supplemental  to  get  that  done.  And  so  there's  been  complete 
support  for  this  throughout  the  administration  and  from  the  Con- 
gress. 

Mr.  Turner.  Inasmuch  as  you've  had  sufficient  funds  to  pursue 
Y2K  compliance,  what  are  the  reasons  then  for  the  delay  in  the  im- 
plementation of  the  Balanced  Budget  Act? 

Ms.  DeParle.  Well,  it's  a  matter  of  the  complexity  of  some  of  the 
changes  that  were  made  in  the  Balanced  Budget  Act.  We've  imple- 
mented, I  think,  almost  200  of  the  more  than  300  provisions  that 
were  in  the  Balanced  Budget  Act.  But  there  are  a  few  provisions 
that  are  extremely  complicated,  like  developing  new  payment 
methodologies  for  home  health  agencies  and  for  rehabilitation  hos- 
pitals and  for  outpatient  departments  of  hospitals.  Our  IV&V  con- 
tractor, AverStar,  came  to  me  last  April  or  May,  I  think  it  was,  and 
made  the  strong  recommendation  that  we  stop  that  work,  that  we 
not  proceed  with  trying  to  make  those  changes,  because  it's  one 
thing  to  make  them  on  paper,  in  the  law,  up  here  and  for  us  to 
write  the  regulation  and  the  policy. 

But  when  you  have  to  start  implementing  those  changes  into  the 
software — and  you  had  these  contractors  who  were  trying  to  ren- 
ovate and  test  the  50  million  lines  of  code  at  the  same  time  that 
they're  trying  to  implement  complicated  software  changes — our 
IV&V  contractor  told  me  in  no  uncertain  terms  that  that  would  not 
be  a  prudent  thing  to  do.  So  we  had  to  stop  that  work.  We're  going 
to  resume  it  as  soon  as  it  is  feasible  after  January  1,  2000.  And 
I  hope  we  will  be  close  to  being  on  track.  But  I  felt  I  had  no  choice, 
because  this  had  to  be  the  No.  1  priority. 

Mr.  Turner.  Well,  as  you  know,  there's  been  quite  a  few  hard- 
ships created,  particularly  in  the  home  health  area  in  recent 
months,  and  it  seems  to  me  that  what  you're  telling  us  is  that  it 
was  your  concern  about  the  ability  of  some  of  the  contractors  to 
perform  both  tasks;  that  is,  to  be  able  to  implement  the  new  re- 
quirements of  the  Balanced  Budget  Act  and  to  be  Y2K  compliant, 
that  caused  you  to  make  that  decision. 

Ms.  DeParle.  That's  right.  And  at  the  point  in  time  that  we 
were — and  I  think  you've  heard  from  our  colleagues  at  the  GAO 
about  the — from  the  chairman  himself.  There's  nothing  that  can 
change  this  deadline  of  January  1,  2000.  And  even  with  more 
money,  we  couldn't  necessarily  be  sure  that  we  were  going  to  get 
the  work  done  at  the  level  and  the  quality  that  it  needed  to  be 
done.  So,  I  was  faced  with  a  choice  of  do  I  want  to  be  sure  that 
we're  paying  claims  January  1,  2000,  or  do  I  want  to  get  these 
extra  things  done. 

And  that  was  a  hard  choice.  But  as  I  said,  I  felt  I  had  no  choice. 
I  had  to  be  sure  we  were  going  to  have  our  systems  ready. 

Mr.  TURNER.  Did  the  law  itself  impose  deadlines  upon  you  that 
you,  in  effect,  did  not  comply  with  or  was  this  within  the  discretion 
of  the  agency? 

Ms.  DeParle.  The  law  itself  imposed  deadlines  in  two  or  three 
areas.  In  the  home  health  area,  the  Congress,  once  we  had  in- 
formed the  authorizing  committees,  last  summer  made  some 
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changes  in  the  home  health  interim  payment  system  to  try  to  cor- 
rect some  of  the  problems  that  had  occurred  from  that  and  also  ex- 
tended the  deadline.  The  original  deadline  was  October  1,  1999  to 
implement  this  new  prospective  payment  system. 

And,  in  fact,  before  we  even  started  on  it,  as  you  may  recall, 
there  was  some  doubt  about  whether  it  could  be  implemented  so 
quickly  and  the  Congress  included  in  the  law  an  automatic  15  per- 
cent reduction  for  the  home  health  agencies  in  the  event  that  we 
did  not  implement.  And  so  last  summer,  what  the  Congress  did, 
was  decide  to  change  that.  And  they  extended  for  another  year  the 
implementation.  It's  now  October  1,  2000,  and  we're  on  track  to 
meet  that. 

Mr.  Turner.  I  might  ask,  Mr.  Willemssen,  if  you  had  any  over- 
sight over  that  particular  decision,  and  did  you  concur  with  the  de- 
cision that  was  made? 

Mr.  Willemssen.  I  would  want  to  emphasize  one  point  that  the 
Administrator  made,  any  time  that  additional  changes  are  made  to 
the  software,  if  indeed  that  system  has  been  deemed  compliant, 
HCFA  and  the  contractor  will  have  to  go  back  in  and  retest  and 
recertify  that  the  changes  that  were  made  have  not  changed  the 
system  in  such  a  way  that  it  was  now  not  year  2000  compliant.  So 
that  adds  an  incredible  extra  amount  of  effort  beyond  what  would 
otherwise  have  to  be  done. 

Mr.  Turner.  My  time  is  about  to  expire.  Thank  you,  Mr.  Chair- 
man. 

Mr.  Horn.  The  gentleman  from  Tennessee,  Mr.  Gordon. 

Mr.  Gordon.  Thank  you,  Mr.  Chairman.  One  of  the  common  de- 
nominators that  I  see  between  Federal  agencies  and  the  private 
sector  in  the  Y2K  problem  is  no  matter  how  well  the  agency  or  a 
corporation  might  get  their  act  together,  they're  still  somewhat  hos- 
tage to  vendors  and  providers.  So  I  guess,  Administrator  DeParle, 
no  matter  how  good  a  job  that  you  might  do  with  your  agency,  you 
know,  how  much  at  risk  are  you  with  these  vendors  and  providers, 
and  what  can  be  done,  and  where  does  that  stand? 

Ms.  DeParle.  Well,  with  vendors  that  we  deal  with  in  Baltimore, 
we  will  make  sure  that  they're  either  Y2K  compliant  or  that  we 
have  a  contingency  plan  in  place  to  get  around  them.  But  the  area 
that  I'm  most  concerned  about  now,  as  we  begin  to  see  daylight  on 
finishing  our  work  and  getting  that  done  with  the  contractors,  is 
what  about  all  of  these  providers. 

And  as  I  said,  we  took  the  unprecedented  step  of  writing  a  letter 
directly  to  all  of  them.  We  do  not  usually  do  that.  Normally,  the 
contractors  deal  with  the  providers,  because  that's  where  the 
claims  come  in.  We  do  not  deal  with  them  directly.  But  we  have 
been  trying  to  be  much  more  aggressive  than  we  ordinarily  would, 
because  I'm  worried  some  of  them  will  wait  until  the  last  minute 
and  try  to  make  these  changes  and  they  will  not  be  able  to  do  it. 

Even  if  I'm  sitting  there  and  my  contractors  are  ready  to  pay. 
claims,  they  will  not  be  able  to  generate  a  claim.  I  think,  as  I  said 
earlier,  the  good  news  is  that  based  on  what  we  know  so  far,  we 
set  a  deadline.  We  started  telling  them  a  year  and  a  half  ago  that 
they  had  to  be  able  to  submit  claims  in  an  eight  digit  format  so 
there  would  be  four  digits  for  the  year,  so  those  would  be  compli- 
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ant,  and  we  have  extended  the  deadline  a  couple  times.  The  dead- 
line is  now  April  of  this  year. 

And  there's  been  some  complaining,  but  from  what  we're  seeing, 
the  compliance  is  really  jumping  up.  So  I'm  hoping  that  is  a  good 
sign  that  providers  will  be  ready.  But  I  continue  to  share  Congress- 
man Turner's  concern  that  there  are  going  to  be  providers  out 
there  whose  awareness  is  not  what  it  should  be  and  that  they're 
not  going  to  be  ready.  And  from  the  standpoint  of  our  beneficiaries 
that  is  what  concerns  me. 

Mr.  Gordon.  You  know,  any  time  you  deal  with  a  complex  prob- 
lem, you  have  to  have  priorities.  And  I  think  that  it's  wise  as  it — 
within  this  problem  to  establish,  as  has  been,  so-called  critical  or 
noncritical  missions.  And  we  mostly  talked  about  the  critical  mis- 
sions. Tell  me  a  little  bit  about  the  noncritical  missions.  You  know, 
what  are  some  of  the  things  that  may  not  get  done  because  you  can 
only  do  so  much,  and  what  impact  are  you  going  to  have? 

Ms.  DeParle.  Well,  for  example,  I  mentioned  that  in  December 
we  finished  renovating  and  testing  all  of  our  25  mission-critical  in- 
ternal systems,  the  ones  that  we  operate  in  Baltimore.  And  those 
include  systems  like  the  one  that  makes  Medicaid  payments  to  the 
States  and  the  one  that  makes  managed  care  payments  to  man- 
aged care  organizations  for  Medicare.  It  did  not  include  some  other 
systems  that  we  are  in  the  process  of  renovating  now,  and  I  believe 
we're  going  to  make  the  March  deadline  on  those.  But  there  are 
things  like  surveys  that  we  do  of  beneficiaries  and  other  sorts  of 
software  that  we  maintain  to  keep  data  on  beneficiaries. 

Those  things  would  be  of  a  lower  priority  as  we  move  toward 
what  are  our  essential  missions.  And  that's  sort  of  how  we've  done 
our  contingency  planning,  focusing  on  what  are  our  essential  mis- 
sions. For  example,  what  has  to  happen  on  day  one  to  keep  our 
business  functioning.  There  will  be  things  such  as  beneficiary  edu- 
cation and  things  like  that,  that  might  not  happen  if  we  are  in  a 
contingency  mode  for  some  reason. 

Mr.  Gordon.  OK,  thank  you. 

Mr.  HORN.  Now,  I  yield  5  minutes  to  the  vice  chairman  of  the 
Subcommittee  on  Government  Management,  Information,  and 
Technology,  Mrs.  Biggert  of  Illinois. 

Mrs.  Biggert.  Thank  you,  Mr.  Chairman.  Ms.  DeParle,  it  seems 
like  you've  got  an  awful  lot  to  accomplish  here,  and  you  have  made 
this  your  top  priority  and  are  working  very  hard  to  accomplish  it. 

Are  you  still  able  to  do  business  as  usual  and  really,  you  know, 
continue  with  what  you  are  working  on,  such  as  Medicare,  Medic- 
aid plus  program  and  things  like  that?  Do  you  have  enough  person- 
nel to  continue  on  your  regular  scope  of  business? 

Ms.  DeParle.  Well,  there's  no  question  that  we're  stretched.  And 
for  example,  on  the  ones  that  you  raised  and  on  the  many  other 
things  that  we're  doing,  the  other  Medicaid  tasks,  Medicare,  bene- 
ficiary education,  we're  probably  not  doing  as  much  on  those  as  we 
would  have  been.  It  is  not  because  those  staff  are  working  in  infor- 
mation systems  and  making  the  renovations  or  overseeing  that,  but 
because  we've  had  to  deploy  staff  to  go  out  to  contractors  and  over- 
see their  work. 

And  we  have  a  lot  of  staff  working  right  now,  I  think  maybe  al- 
most 100  people  of  our  4,000  are  working  virtually  full-time,  on 
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contingency  planning  because  we  have  to  get  that  done  by  March. 
So  I  think  it  has  probably  slowed  down  progress  in  other  areas. 

You  heard  the  questions  that  Congressman  Turner  asked  me 
about  the  Balanced  Budget  Act.  When  you  make  something  your 
top  priority,  it  means  that  you're  probably  diverting  attention  from 
other  things.  I  think  we're  getting  our  essential  missions  accom- 
plished despite  that.  But  there's  no  question  that  Y2K  has  been 
something  that  we  had  to  put  our  full  focus  on.  And  certainly  in 
the  information  systems  area,  which  is  one  of  this  committee's  in- 
terests, Dr.  Christoph  I  brought  from  the  Los  Alamos  National 
Laboratory  to  help  us  develop  a  new  information  technology  infra- 
structure, which  is  something  that  we  need. 

That  isn't  what  he's  been  doing.  He  has  spent  his  full  time  work- 
ing on  managing  this  Y2K  project,  because  this  is  what  we  had  to 
get  done. 

Mrs.  BlGGERT.  Thank  you.  Then  you,  in  your  testimony,  talked 
about  the  States,  as  well  as  providers,  but  the  State  as  the  pro- 
vider, and  said  you  don't  really  have  the  authority  to  demand  that 
they  are  compliant.  But  you're  working  with  them.  Are  there  any- 
well,  are  you  working  with  the  States  really  to  educate  them  on 
this  as  a  top  priority,  and  what  else  can  be  done  to  ensure  then 
that  the  State  systems  will  not  fail? 

Ms.  DeParle.  Well,  we  are  working  with  the  States,  and  we 
started  that  well  over  a  year  ago  by  sending  them  the  GAO's  guide- 
lines on  what  they  should  be  doing.  But  last  summer,  I  became 
concerned  about  where  the  States  were,  because  we  were  getting 
self-reported  data  from  them  that  didn't  give  me  confidence  that 
they  were  all  sufficiently  on  top  of  it.  The  GAO  was  also  looking 
at  it  and  was  getting  similar  data  that  they  reported  to  the  Con- 
gress in  November. 

So  we  ended  up  hiring  an  IV&V  contractor  to  go  out  to  the  States 
to  investigate  how  they  were  doing.  There  are  two  main  systems 
that  they  operate  that  are  critical  to  Medicaid.  One  is  their  eligi- 
bility system,  and  the  other  is  their — what's  called  their  MMIS, 
their  Medicaid  Management  Information  System.  And  we  have 
sent  independent  contractors  out  to — I  think  we've  been  to  16 
States  now,  and  it  will  be  20  by  the  end  of  the  month  and  by  April 
we  will  have  been  to  all  50  States — to  just  investigate  how  they're 
doing. 

We're  working  directly  with  them,  sending  them  the  results  in 
the  same  way  that  GAO  would  send  us  the  results,  giving  them  an 
opportunity  to  comment,  but  we're  going  to  aggressively  identify 
the  problems  there.  We're  also  asking  to  see  their  contingency 
plans. 

And  by  the  way,  we  pay  for  this.  You  should  know  that  Congress, 
through  the  Medicaid  program  will  pay  for  States'  remediation  ef- 
forts, 75  percent,  as  well  as  if  they  had  wanted  to  hire  IV&V  con- 
tractors, you  would  have  paid  for  that.  And  we  urged  them  to  do 
it.  Most  of  them  weren't  doing  it,  which  is  why  we  decided  to  do 
it  ourselves. 

Mrs.  Biggert.  Are  there  other  working  groups,  like  say  as 
groups  of  hospitals,  are  you  getting  together  with  them  to  discuss 
the  problems? 
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Ms.  DeParle.  Yes.  We're  meeting  on  a  biweekly  basis  with  all 
the  different  trade  associations  in  town  that  deal  with  health,  and 
I've  met  personally  with  the  State  Medicaid  directors,  with  the  hos- 
pitals, with  the  managed  care  plans.  We've  had  hundreds  of  meet- 
ings with  them  about  this. 

Mrs.  BlGGERT.  Is  that  a  definite  structure  that's  set  up  and  when 
did  that  start  to  occur? 

Ms.  DeParle.  It  started,  I  want  to  say,  in  earnest  in  late  spring 
or  summer  of  last  year — the  outreach  effort — and  has  been  continu- 
ing, as  I  said,  on  a  biweekly  basis  since  then. 

Mr.  Callahan.  I  might  add,  if  I  could  on  that,  John  Koskinen, 
who  is  the  President's  special  advisor  in  year  2000,  has  asked  all 
the  various  Federal  agencies  to  share  various  sector  groups.  The 
health — the  overall  health  and  the  human  services  sector  group  is 
shared  by  the  Deputy  Secretary  in  our  department,  Kevin  Thurm, 
and  as  Nancy  Ann  has  mentioned,  we  do  have  periodic  meetings 
with  the  health  care  sector,  not  just  hospitals,  but,  for  example,  at 
a  recent  meeting  with  the  pharmaceutical  association,  the  drug 
stores,  the  Veterans  Administration,  et  cetera.  So  we're  actively 
reaching  out  to  them  to  get  their  best  information  possible  as  to  the 
Y2K  situation. 

Mrs.  BlGGERT.  Just  one  last  question.  GAO  talked  about  every 
time  there's  a  change  or  someone  is  not  in  compliance  then  it  has 
to  be  retested  and  reworked.  What  time  do  you  envision  that  you 
would  be  able  to  test  every  system  and  if  it  works,  and  if  it  doesn't, 
will  you  still  have  enough  time  to  rework  it?  Is  that  like  October? 

Ms.  DeParle.  We  plan  to  complete  our  end-to-end  testing  by  the 
end  of  October.  And  in  July,  we're  going  to  freeze  all  of  our  sys- 
tems, in  other  words,  not  make  any  other  changes  that  would  re- 
quire another  whole  round  of  testing.  But  he's  exactly  right,  that's 
been  one  of  the  complications  of  what  we  do,  because  so  much  of 
what  we  do  involves  making  updates  and  changes  and  that  kind 
of  thing.  And  if  you're  doing  that,  it  interferes  with  the  work  you 
need  to  do  to  make  sure  everything  is  compliant. 

Mrs.  BlGGERT.  Thank  you  very  much.  Thank  you,  Mr.  Chairman. 

Mr.  HORN.  Thank  you.  We  will  now  start  on  round  two  of  5  min- 
utes apiece.  I  would  like  to  just  clarify  what's  compliant  and  what 
isn't. 

Mr.  Secretary,  as  I  look  at  what  the  whole  department  submit- 
ted, they  said  there  was  a  dramatic  34  percent  increase  this  quar- 
ter. And  I'm  just  curious,  I  think  it  was  made  up  of  96  critical  mis- 
sion systems,  as  I  recall,  and  then  the  question  would  be,  is  the 
Medicare  54  part  of  the  96? 

Mr.  Callahan.  Yes,  I  believe  it  is,  sir. 

Mr.  HORN.  OK.  Then  the  question  gets  down,  Mr.  Willemssen,  do 
you  think  their  view  of  compliance  and  the  General  Accounting  Of- 
fice's view  of  compliance,  do  you  think  we're  on  the  same  wave- 
length or  is  there  a  discrepancy  here? 

Mr.  WILLEMSSEN.  We  definitely  have  a  discrepancy  on  those  54 
systems. 

Mr.  HORN.  And  what  do  you  think  has  to  be  done  to  make  them 
come  into  compliance?  ,  _ 

Mr.  Willemssen.  We  not  only  have  to  go  m  and  change  the  soft- 
ware to  deal  with  the  problems  that  have  been  identified,  but  you 
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also  then  have  to  test  that  those  changes  have  fixed  the  problems 
that  were  previously  identified.  And  that — we  haven't  seen  that 
evidence  for  those  54  yet. 

Mr.  Horn.  Any  reaction  of  both  the  Administrator  and  the  Sec- 
retary? 

Ms.  DeParle.  Weil,  I  think  part  of  what  Mr.  Willemssen  is  talk- 
ing about  is,  as  auditors,  the  GAO  relies  on  the  paper  trail,  and 
they  looked  at  the  self  certifications  that  we  got  at  the  end  of  De- 
cember, and  they  were  looking  at  the  paper  trail.  The  qualifications 
that  were  given  to  us  were  worded  quite  broadly.  They  were  writ- 
ten by  lawyers.  That  shouldn't  surprise  me,  since  I'm  the  one  who 
started  this  by  saying  I  wanted  a  contract  amendment.  But  what 
I  think  the  GAO  wants  to  see  is  paper  evidence  again  that  they  can 
rely  on  to  say  that  those  things  have  happened,  and  I  think  we 
should  get  the  GAO  that. 

Mr.  Horn.  Well,  as  you  know,  the  basis  for  judgment  both  by  the 
executive  branch  and  the  legislative  branch  is  the  fact  that  we  deal 
with  self-reported  data,  and  that's  why  we  try  to  clarify  when  we 
get  into  one  of  these  things  as  to  the  degree  of  progress  a  particular 
department  is  making,  such  as  Health  and  Human  Services.  We 
want  to  figure  out  what's  backing  those  numbers,  and  is  there  an 
agreement  on  definitions  so  we're  all  singing  from  the  same  hymn 
book  and  that  we  don't  have  dissidents,  we  have  harmony,  and 
that's  why  we're  fishing  to  see  if,  indeed,  we  really  have  had  more 
systems  comply  in  this  last  round  that  we've  reported  on  last  week. 
And  I  take  it  you  agree  that  there's  still  a  lot  of  work  to  be  done 
to  make  them  really  compliant? 

Ms.  DeParle.  Well,  actually  on  a  couple  of  systems  that  the 
GAO  has  expressed  concerns  about,  and  I  mentioned  the  one  in 
Florida.  We  believe  we've  given  them  the  documentation  that 
should  have  satisfied  them. 

And  just  to  follow  your  point,  Mr.  Chairman,  I  also  don't  want 
to  rely  just  on  paper,  because  I  learned  very  quickly  that  wasn't 
good  enough,  and  that's  why  I  asked  a  number  of  our  employees 
to  leave  their  home  base  to  go  to  Little  Rock,  AR  and  Richmond, 
VA  and  places  where  they  don't  live,  to  be  onsite  with  these  con- 
tractors to  make  sure  what  the  contractors  were  telling  us  was 
what  was  happening. 

So  we  have  more  thorough  information  than  anyone  else  does 
about  this.  But  having  said  that,  you  know  Mr.  Willemssen  has 
been  very  helpful  to  us,  and  I  trust  his  assessment  of  this.  And  I 
want  to  make  sure  that— I  don't  have  any  interest  in  relying  on 
something  that  isn't  accurate.  So  I  want  to  make  sure  that  the 
GAO  is  satisfied. 

Mr.  Horn.  Well,  may  I  suggest  that  both  the  General  Accounting 
Office  and  your  agency,  HCFA,  agree  on  a  pattern  of  testing  just 
to  solve  this  problem  and  make  sure  everybody  is  talking  the  same 
language? 

I  want  to  move  on  now,  Mr.  Callahan,  to  an  area  in  which  you 
are  involved.  Very  few  of  the  departments  merged  the  Chief  Infor- 
mation Officer  role  with  the  Assistant  Secretary  for  Management. 
How  did  that  happen  in  HHS? 

Mr.  Callahan.  Mr.  Chairman,  you  and  I  have  had  some  previous 
discussions  on  this.  We  are  a  very  centralized — we  have  a  very  cen- 
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tralized  management  system  at  headquarters  in  HHS.  For  exam- 
ple, I  am  the  Assistant  Secretary  of  Management  and  Budget, 
Chief  Information  Officer.  I'm  also  the  Chief  Financial  Officer. 
There  are  days  when  I  probably  wish  I  could  shed  some  of  those 
responsibilities. 

Mr.  Horn.  But  don't  you  need  somebody  else  to  work  18  hours 
a  day,  7  days  a  week? 

Mr.  Callahan.  Let  me  say  this,  I  don't  do  it  all  myself  obviously, 
but  we  have  able  Deputies,  Deputy  CIO  Dr.  Stillman,  et  cetera. 
But  the  key  point  here  is  we  are  able  to  move  very,  very  quickly 
on  behalf  of  the  Secretary  and  the  Deputy  Secretary  to  make  those 
decisions,  I  think,  which  help  the  Y2K  situation.  For  example,  in 
the  area  that  Administrator  DeParle  mentioned  last  year,  HCFA 
indicated  that  they  needed  an  additional  $40  million  on  an  urgent 
basis.  Because  I'm  the  Assistant  Secretary  of  Management  and 
Budget  and  work  with  the  Secretary  and  execute  the  authority  we 
have  to  transfer  up  to  1  percent  of  our  appropriations  among  ac- 
counts, we  were  able  to  execute  that  and  do  it  in  record  time  so 
that  in  essence  we  met  that  deadline.  I  dare  say  that  other  depart- 
ments would  not  have  been  able  to  do  it  as  quickly  or  as  effectively 
as  we  did.  So  there  are  benefits  in  centralization. 

Mr.  Horn.  Well,  there's  also  when  we  could  get  two  other  fine 
people  like  you  working  on  various  aspects,  both  the  financial  and 
the  information  side,  it  seemed  to  me  we  would  make  a  little  more 
progress,  because  this  is  just  a  heavy  job,  you  all  know  that. 

Mr.  Callahan.  Yes,  sir. 

Mr.  Horn.  And  Treasury  did  the  same  thing,  and  Treasury  has 
got  major  problems  I  think  because  of  that,  where  they  didn't  have 
a  new  business  and  focus  of  energy  in  an  area  to  straighten  it  up. 
I  will  get  back  to  a  few  other  questions  later.  But  let  me  now  yield 
to  Mrs.  Morella,  the  gentlewoman  from  Maryland. 

Mrs.  Morella.  Thank  you.  You  know,  one  of  the  concerns  with 
regard  to  this  computer  glitch  is  how  the  public  is  going  to  react. 
I  mean  attitude,  whether  it's  going  to  be  panic,  whether  it's  going 
to  be  a  laissez-faire  concept  that  we  don't  have  to  worry  about  any- 
thing. I  always  say  it's  between  Chicken  Little  and  Pollyanna,  in 
terms  of  where  we  should  be.  But  how  are  you  communicating  with 
the  public  to  assuage  concerns  that  people  may  have — and  that  I 
think  will  be  exacerbated  as  we  get  closer  to  the  date  and  you're 
hearing  more  and  more  about  Y2K.  I  mean  Steve  and  I  were  in- 
volved in  this  3  years  ago  as  we  started,  but  only  now  are  people 
beginning  to  realize,  you  know,  Mark  Gordon  and  others,  are  begin- 
ning to  realize  that  this  is  a  situation  where  we  can't  have  a  con- 
tinuing resolution. 

Do  you  have  a  responsibility  to  communicate,  to  establish  infor- 
mation lines,  again,  to  assuage  concerns  that  your  recipients, 
whether  it's  agencies,  States,  individuals,  are  experiencing  or  will 
experience? 

Mr.  Callahan.  Congresswoman  Morella,  we  absolutely  have  that 
responsibility,  and  we  have  that  responsibility  in  the  context,  as 
you  know,  of  working  with  John  Koskinen  under  the  President's 
Y2K  Conversion  Council.  He  has  made  it  clear  that  one  part  of  his 
efforts  in  terms  of  advising  the  President  and  the  general  public  is 
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to  give  periodic  reports  to  the  President  and  the  general  public 
about  our  Y2K  readiness  and  our  ability  to  meet  the  Y2K  situation. 

As  Administrator  DeParle  mentioned,  she's  worked — she  sent  out 
nearly  1.25  million  letters  to  the  providers,  hospitals,  doctors,  et 
cetera,  who  have  to  on  their  own,  as  you  know,  they  have  to  work 
hard  to  meet  their  side  of  the  Y2K  question.  We  intend  to  obviously 
offer  this  committee  and  the  public  as  much  information  as  we  can 
as  to  the  situation  with  regard  to  Y2K  readiness.  So  you're  abso- 
lutely right.  We  have  that  responsibility,  and  we  will  exercise  that. 

Mrs.  MORELLA.  Would  any  of  you  like  to  comment  on  it? 

Ms.  DeParle.  Just  one  more  comment.  Another  thing  we've  been 
doing  more  recently  in  this  health  care  sector  group  that  I  men- 
tioned that's  working  together  with  the  various  hospital,  doctor  and 
other  groups,  rural  providers  and  others,  on  outreach  is  our  first 
level  of  reaching  out  to  the  actual  providers  themselves,  to  make 
sure  they're  ready,  because  that's  the  best  risk  mitigation  strategy 
you  can  have  is  to  make  sure  they're  ready. 

But  we  do  think  the  next  step  is  to  work  together  to  reassure  the 
public,  and  we  think  that's  something  that  we  should  do  as  an 
agency  and  as  a  department  with  the  providers.  So,  for  example, 
we've  been  working  with  the  drug  companies  on  how  we  will  reas- 
sure the  public  on  those  issues  and  the  Deputy  Secretary  of  the  de- 
partment is  leading  that  effort.  We're  working  with  the  hospitals 
on  how  we  will  reassure  the  public  about  their  readiness.  So  that's 
sort  of  the  next  step  of  this. 

Mr.  WlLLEMSSEN.  If  I  may  make  two  points,  one  general  and  one 
a  little  bit  more  specific.  The  general  point  is  the  best  way  to  com- 
bat public  panic  is  with  hard  data,  and  the  Federal  Government  is 
obviously  in  the  lead  on  that  and  has  been  for  some  time.  Federal 
agencies  can  provide  data  on  where  they're  at,  and  they  will  have 
organizations  such  as  GAO  coming  in  and  looking  at  where  they're 
at,  and  making  assessments  of  that.  So  I  think  to  the  extent  that 
we  can  put  the  data  out  there,  that  will  help  combat  the  fear. 

Second,  and  a  little  bit  more  specific  to  HCFA,  a  hearing  like  this 
obviously  airs  that  HCFA  has  some  issues  and  some  challenges 
ahead  and  that  there  is  a  high  possibility  that  there  will  be  some 
system  failures.  But  to  the  extent  that  HCFA  can  demonstrate 
through  the  remainder  of  this  year  that  the  excellent  efforts  it  will 
have  done  in  the  contingency  planning  area,  it  can  then  say  even 
if  we  do  have  some  system  failures,  don't  worry,  because  we  have 
some  backup  plans  in  place  to  make  sure  that  providers  are  paid 
and  services  are  still  provided. 

Mrs.  MORELLA.  I  see  a  role  for  public  service  announcements, 
maybe  some  other  kind  of  simple  mailer  to  people  to  just  say  we 
are  working  on  it,  we  will  be  all  right.  We  will  have  perhaps,  at 
most,  some  inconveniences,  but  we  want  you  to  know  that  blah, 
blah,  blah,  because  I'm  hearing  more  and  more  from  people,  will 
my  Social  Security  check  be  out  there.  We  say,  oh,  yes,  they  started 
in  1989  and  they're  doing  very  well  and  then  you  get  into  the  other 
areas. 

They  also  want  to  know  what  should  they  ask,  you  know,  par- 
ticularly in  the  medical  field.  I  just  think  all  of  us,  whether  it's 
done  through  agency  by  agency,  I  think  there  should  be  a  strategy 
for  communicating  with  the  public. 
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Mr.  Callahan.  I  do  know,  as  I'm  sure  you're  aware,  that  the 

FTC,  for  example,  has  omnibus  Y2K  consumer  Website  where  

Mrs.  Morella.  Yes. 

Mr.  Callahan  [continuing].  If  you  as  a  consumer  want  to  know 
about  your  microwave,  or  whatever  it  is  you  want  to  know  about, 
you  can  get  into  that,  and  they  will  try  to  provide  you  the  best  an- 
swers as  possible.  As  does  SBA,  for  example,  with  small  businesses. 

Mrs.  Morella.  They  have  their  Website,  I  know.  And  the  other 
day  I  was  at  an  event  for  Red  Cross.  Red  Cross  has  a  wonderful 
little  pamphlet  for  consumers,  for  constituents,  what  should  you 
ask,  what  should  you  know,  what  is  Y2K,  done  very  simply,  noth- 
ing complicated.  But  it  gives  a  feeling  that  we  know  something 
about  it  and  we  will  have  a  part  to  play  and  ultimately  people  are 
working  on  it,  it  will  be  OK. 

Thank  you  all  very  much.  Thank  you,  Mr.  Chairman. 

Mr.  HORN.  Thank  you.  Now  I  yield  5  minutes  to  questioning  to 
the  ranking  member  of  the  Government  Management,  Information, 
and  Technology  Subcommittee,  Mr.  Turner  of  Texas. 

Mr,  Turner.  Dr.  Callahan,  you  mentioned  that  you're  having  to 
operate  both  computer  systems  for  the  payment  management  sys- 
tems for  the  year  2000.  The  old  system  has  been  updated  and  you 
still  got  the  new  system  you're  bringing  on  line. 

Mr.  Callahan.  I  might  correct  that.  Let  me— I  don't  want  to  in- 
terrupt, but  that's  not  quite  precise,  but  I  will  

Mr.  Turner.  Go  ahead,  if  I  misstated  it. 

Mr.  Callahan.  Actually  the  reengineered  payment  management 
system,  which  is  the  one  that  we  want  to  put  in  place  of  the  exist- 
ing system,  is  not  operational.  This  was  brought  about  as  a  busi- 
ness decision  starting  in  1994.  A  basic  decision  was  made  that  we 
should  have  a  new  payment  management  system,  and  we  will  pro- 
vide you  a  chronology  of  what's  happened  with  regard  to  that  sys- 
tem. 

[The  information  referred  to  follows:] 


I 
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ANSWER:  The  chronology  of  the  reengineered  Payment  Management  System 
(PMS)  is  as  follows: 

CHRONOLOGY  OF  REENGINEERED  PMS 

June  1993  Business  Review  -  Logistics  Management  Institute  (LMI) 

1994  Business  decision  to  reengineer  PMS 

Sept  1995  Focus  group  meetings  to  assess  User's  needs 

July  1 995  PRC-  Started  design  of  new  system  (Phase  I) 

April  1997         LMI  -  Quality  Review  of  PRC  design  documents 

Dec.  1997  Contracted  Logicon  Corp.  for  Reengineering  Construction  Phase 

(Phase  II) 

Jan.  1 998         Contracted  KPMG  for  management  support  and  IV &  V 

Dec.  1998  Remediated  code  for  Legacy  System  Y2K 

Jan.  1999         Contracted  with  Averstar  Corp.  to  assess,  support  and  monitor 
the  PMS  Y2K  compliance  efforts. 

Feb.  1999  Decision  made  -  Make  Legacy  system  Y2K  compliant 

Feb.  1999  Continue  construction  of  the  Reengineered  PMS 
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Mr.  Callahan.  It  was  our  intention — we  had  hoped  that  that 
new  system  would  be  fully  in  place  by  December  1998  and  Y2K 
compliant.  Obviously,  it  was  built  to  be  Y2K  compliant.  But  it  was 
scheduled  to  be  in  place  and  operational  by  December  1998  and 
then  we  would  be  able  to  replace  the  current  system. 

During  the  latter  part  of  1998,  as  we  were  looking  at  it,  we  un- 
derstood that  there  may  be  slippages.  So  we  then  in  November 
1998  with  our  current  system — that's  the  system  that  operates,  it's 
ongoing  today  and  it  does  all  of  these  things  that  I  mentioned  ear- 
lier— we  said  we  have  to  go  back  and  look  at  its  code  and  remediate 
its  legacy  code  to  be  Y2K  compliant. 

We  did  that  in  November;  the  code  has  been  fully  remediated, 
the  code  itself  and  the  current  operating  system  is  Y2K  compliant. 
But  it  has  to  go  through  further  testing  and  certification  through 
an  independent  contractor.  At  that  time  we  also  contracted  with 
the  Avistar  Corp.  and  said,  look,  this  is  where  we  are,  we've  got 
to  remediate  it,  we  want  to  do  two  things.  We  want  to  be  Y2K  com- 
pliant as  fast  as  possible,  and  then,  second,  we  want  to  have  for 
the  future  as  a  business  case  a  better  payment  management  sys- 
tem. 

They  looked  at  where  we  were,  both  on  the  remediation  of  the 
legacy  code  system  and  this  new  reengineered  payment  manage- 
ment system,  and  gave  us  the  report  which  basically  says  what  you 
should  do  is,  first  of  all,  devote  all  of  your  current  efforts  between 
now,  and  they  estimate  June  and  they  have  a  detailed  timeline,  et 
cetera,  to  make  sure  that  the  current  system  which  you've  remedi- 
ated, the  legacy  code  system,  will  be  fully  Y2K  compliant. 

However,  at  the  same  time  or  after,  as  you  finish  that  up,  you 
should  not  forego  developing  a  new  reengineered  system.  They  felt 
that  the  code  that  we  had  developed  in  that,  not  all  were  hardware, 
not  all  were  conversions,  et  cetera,  that  it  was  a  good  business  case 
to  continue  to  proceed  with.  But  they  said,  you  can't  do  that  at  the 
same  time  you're  doing  all  of  this  repair  to  the  current  system.  But 
they  said  don't  give  up  on  the  business  case,  but  put  it  second. 

That's  exactly  what  we  intend  to  do,  so  that  we  will  have  a  Y2K 
compliant  system  by  June,  the  current  system,  and  then  hopefully, 
if  everything  works  out  right,  we  will  have  a  second  system  that 
will  be  Y2K  compliant.  But,  obviously,  we  would  not  move  into  that 
second  system  until,  unless  and  until,  it  can  be  proven  that  there 
will  be  no  disruption  in  service. 

And,  again,  we  think  the  report  that  Avistar  gave  us  was  an  ex- 
cellent roadmap.  It  will  be  provided  to  GAO.  It's  candid.  It  says 
this  is  where  you've  been,  and  this  is  where  you  should  go,  and  we 
intend  to  follow  that  as  a  roadmap  and  again  we  will  provide  it  to 
the  committee,  and  we  will  hold  ourselves  to  the  milestones  that 
are  provided  in  this  independent  report. 

Mr.  Turner.  I  only  raised  it  because  it  seems  to  me  to  be  a  very 
obvious  example  of  how  costly  Y2K  compliance  has  become,  be- 
cause you  never  would  have  tried  to  remediate  the  legacy  system 
had  we  not  been  faced  with  Y2K. 

Mr.  Callahan.  Absolutely. 

Mr.  TURNER.  It  might  be  interesting  if  you  could  share  with  us, 
if  you  have  an  estimate,  of  how  much  Y2K  is  going  to  end  up  cost- 
ing the  Department  of  Health  and  Human  Services. 
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[The  information  referred  to  follows:] 


Department  of  Health  and  Human  Services 
Total  Y2K  Costs  -  Fiscal  Years  1996  -  2000 

(As  of  April  2. 1999) 


(Dollars  in  Thousands) 


I  FY  1996 

FY  1997 

FY  1998 

FY  1999 

FY  2000 

TOTAL  II 

|$  7,190 

$  32,213 

$  190,870 

$  427,276 

$  165,168 

$822,717  II 

Mr.  Callahan.  I  can  get  you  all  the  detailed  fiscal  information 
for  the  record. 
Mr.  HORN.  We  will  put  that  in  the  record  at  this  point. 
Mr.  Callahan.  Last  year's  emergency  appropriation  for  Y2K  was 
$3.2  billion,  the  Department  request  under  that  emergency  supple- 
mental $285.3  million.  We  have  received  those  requests,  and  in- 
deed we  received  another  $93  million  fairly  recently  which  HCFA 
has  requested  for  its  second  installment  of  emergency  money. 

So  at  this  point,  we  are  approximately  for  1999  around  $372  mil- 
lion, with  obviously  the  lion's  share  of  that  being  allocated  to 
HCFA  for  its  work  on  its  internal  and  external  systems.  That  is  the 
top  priority  of  the  Department.  / 


Mr.  Turner.  One  final  question  I  want  to  ask  Ms.  DeParle.  I 
know  that  you  have  made  efforts  to  notify  the  providers,  and  you 
have  sent  out  over  1  million  letters  to  the  providers.  In  fact,  I  don't 
know,  Mr.  Chairman,  if  we  have  that  in  the  record  or  not. 

Mr.  Horn.  Two  million. 

Mr.  Turner.  It  might  be  nice  to  place  that  letter  in  the  record. 
Mr.  Horn.  Without  objection. 

Ms.  DeParle.  It  also  went  out  to  every  Member  of  Congress. 
[The  information  referred  to  follows:] 
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Mie  Afl.iiiniit'jtO' 
Washintfton.  O.C.  20201 

January  12,  1999 


Dear  Health  Care  Partner. 

You  have  probably  heard  about  the  Year  2000  computer  problem,  or  the  "Y2K  bug."  As  a  health 
care  practitioner  or  institution,  you  need  to  be  aware  of  how  Y2K  affects  you  and  your  patients 
We  all  must  do  our  pan  so  that  Medicare  and  Medicaid  beneficiaries  continue  to  receive  high 
quality  care,  and  you  or  your  institution  continue  to  be  paid  accurately  and  promptly 

The  Year  2000  problem  appears  simple  on  the  surfa.es.  Many  computers  and  devices  use  only  six 
digits  to  record  dates.  They  may  read  01-01-00  as  January  1,  1900,  rather  than  January  I,  2000 
Patient  care  services,  systems,  and  devices  that  rely  on  dates,  the  age  of  the  patient,  and  other 
calculations  could  be  severely  affected  if  corrections  are  not  made  in  time. 

F.very  business  and  organization  that  relies  on  computer  systems  or  devices  must  address  Y2K 
For  all  of  us  in  the  health  care  industry,  it  is  a  patient  care  issue  as  well  as  a  business  and  technical 
problem.  As  Administrator  of  the  Health  Care  Financing  Administration  (HCFA),  I  need  to  make 
sure  you  are  aware  of  some  key  points: 

►  HCFA  will  be  ready  to  process  acceptable  claims.  We  have  made  substantial  progress 
in  correcting  our  own  systems  in  recent  months  and,  despite  eariier  concerns,  we  will  be 
ready  on  time.  We  are  confident  that  all  Medicare  claims  processes  will  be  ready  and  able 
to  function  come  January  1 ,  2000.  so  that  you  can  be  paid  promptly 

►  You  must  also  be  ready  if  you  wish  to  be  paid  promptly.  We  can  process  your  claims 
only  if  your  systems  are  also  able  to  function  in  the  Year  2000.  It  is  URGEIST  that  vou 
act  NOW  so  your  systems  will  be  ready.  Otherwise,  you  may  not  be  able  to  receive 
prompt  payment  from  Medicare,  Medicaid,  and  virtually  any  other  payer. 

►  Your  entire  practice  and  facility  must  be  ready.  The  Y2K  problem  could  impact 
quality  of  care  and  patient  safety.  Patient  management  systems,  clinical  information 
systems,  defibrillators  and  infusion  pumps  and  other  medical  devices,  even  elevators  and 
security  systems  all  must  be  ready. 

We  want  to  help  you  prepare  for  the  Year  2000.  Enclosed  is  a  "Sample  Provider  Y2X  Readiness 
Checklist"  which  you  can  use  to  assess  what  you  need  to  do.  You  can  find  additional  useful 
information  at  our  www, hcfa.gov/Y2K  web  site.  Information  on  medical  devices  is  available  on 
the  Food  and  Drug  Administration's  www . fda. pov/cdrh/vr2000/vear2000 . html  web  site. 

We  are  confident  that  HCFA  will  be  ready,  but  we  are  also  making  contingency  plans  so  we  can 
continue  operations  if  unexpected  problems  occur  For  those  of  you  that  rely  on  computer 
systems,  we  believe  the  greatest  risk  is  that  your  systems  will  not  be  able  to  bill  for  services 
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You  need  to  make  sure  you  will  be  ready  for  the  Year  2000   And.  like  us.  you  need  to  make 
contingency  plans  for  your  critical  operations  These  should  focus  espeeiallv  on  assurine  suletv 
for  your  patients  who  are  reliant  on  equipment  and  devices  containing  embedded  chips.  In 
addition,  you  need  to  assure  your  ability  to  generate  bills  and  manage  accounts  receivables,  and 
assure  essential  services  and  supplies  are  maintained   Your  patients  and  your  business  ma\ 
depend  on  this. 

What  can  you  do  to  avoid  potential  Y2K  pitfalls?  There  are  key  steps  you  can  take  to  become 


Become  aware  of  how  the  Year  2000  can  affect  your  systems.  Anything  that  depends  on  a 
microchip  or  date  entry  could  be  affected.  Don't  forget  to  identify  those  organizations  that  you 
depend  on  or  who  depend  on  you.  List  everything  and  identify  your  mission  critical  items, 
namely,  those  you  cannot  live  without. 

Assess  the  readiness  of  everything  on  your  list.  You  can  do  this  by  contacting  your  hardw  are  oi 
software  vendors  or  accessing  key  information  from  various  web  sires.  Don't  forget  your 
maintenance  and  service  contractors,    [f youF  particular  software  program  or  form  is  not  Y2K 
ready,  you  need  to  decide  whether  you  should  invest  in  an  upgrade  or  replacement. 

Update  or  replace  systems,  software  programs,  and  devices  you  decide  arc  critical  for  your 
business  continuity. 

Test  your  existing  and  newly  purchased  systems  and  software.  Do  not  assume  that  a  system  or  a 
program  is  Y2K  ready  just  because  someone  said  it  is  Test  to  make  sure.  During  this  process, 
keep  track  of  your  test  plans  and  outputs  in  case  a  problem  surfaces  later.  If  you  are  not  already 
using  compliant  electronic  claim  formats,  consider  testing  your  electronic  data  interchanges  (l.DV) 
with  one  or  more  of  your  payers,  including  Medicare.  This  will  ensure  that  your  payer  can  accept 
your  EDI  transactions,  especially  claims.  Medicare  can  now  accept  claims  with  eight  digit  date 
formats. 

Develop  business  contingency  (continuity)  plans  in  the  event  something  goes  wrong.  Focus  on 
the  things  that  would  be  most  problematic  for  you  and  your  patients. 

The  enclosed  checklist  may  also  be  helpful   It  is  only  meant  to  be  a  guide  and  should  not  be 
considered  all-inclusive. 

Medicare  beneficiaries  are  counting  on  all  of  us  to  meet  the  Year  2000  challenge.  We  will  be 
ready  Now  you  need  to  do  your  part  to  be  sure  that  you  will  continue  to  be  paid  as  beneficiaries 
are  assured  that  they  will  continue  to  receive  the  health  care  they  have  come  to  depend  on. 


Y2K  ready: 


Sincerely, 


Nancy- Ann  Min  DeParle 


Enclosure 
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Mr.  Horn.  Let  me  say,  if  I  might,  to  my  colleague,  if  you  want 
a  Member  of  Congress  to  read  it,  put  on  it  "personal  and  confiden- 
tial" and  it  will  go  in.  Otherwise  it  is  in  the  box  of  junk  mail.  I  am 
one  of  the  rare  ones  that  reads  all  of  that  stuff  every  2  weeks. 

Ms.  DeParle.  It  came  out  in  early  January,  so  I  was  hoping 
maybe  during  the  recess  there  would  be  a  little  more  time  to  look 
at  things.  I  was  hoping  some  of  you  might  use  that  information  in 
your  newsletters  that  I  know  you  send  to  district  folks. 

Mr.  Turner.  I  see  my  time  has  expired.  One  subject  I  wanted  to 
touch  upon  briefly,  I  wanted  to  get  your  assessment  of  the  risk  that 
we  face  in  the  biomedical  equipment  area.  I  know  you  have  made 
some  efforts  to  try  to  get  the  biomedical  equipment  manufacturers 
to  notify  all  the  providers  regarding  Y2K  problems.  But  how  do  you 
personally  assess  that  risk?  That  is  one  that  greatly  concerns  me, 
particularly  being  from  a  rural  area,  where  we  have  a  lot  of  old 
equipment  in  rural  hospitals.  What  is  your  assessment  and  what 
do  you  think  you  can  still  do  to  minimize  that? 

Ms.  DeParle.  I  have  focused  on  the  claims  processing  and  pay- 
ment systems.  That  is  what  the  Health  Care  Financing  Adminis- 
tration does.  I  think  Dr.  Callahan  can  give  you  a  better  answer  on 
that. 

Mr.  Callahan.  The  Federal  Food  and  Drug  Administration  is 
the  agency  within  the  Department  that  has  to  take  that  task  on 
you  are  so  concerned  about.  I  do  know  they  have  been  requested 
by  the  full  committee  for  a  variety  of  questions  and  answers  related 
to  the  biomedical  situation  that  those  will  be  forthcoming,  I  believe 
in  the  next  day  or  so,  and  we  would  like  to  provide  those  to  you 
for  the  record. 

Let  me  say  in  general,  however,  the  FDA  has  moved  aggres- 
sively, along  with  other  partners  in  the  government,  the  Veterans 
Administration  and  others,  to  put  up  on  a  Website  the  Y2K  compli- 
ance aspects  of  biomedical  devices. 

But  in  addition,  what  is  also  important,  Congressman  Turner,  as 
you  know,  is  that  each  hospital  and  health  care  provider  that  has 
biomedical  equipment  has  to  go  in  and  do  an  inventory  of  that 
equipment.  They  have  to  know  what  equipment  they  have  on  hand. 

For  example,  the  Indian  Health  Service,  under  the  jurisdiction  of 
the  Department,  has  completed  its  total  inventory,  as  I  understand 
it,  of  all  the  biomedical  equipment  that  they  have  in  their  hos- 
pitals. They  are  matching  that  information  against  the  FDA 
Website  and  working,  again,  with  an  independent  contractor  to  de- 
termine what  of  that  biomedical  equipment  is  not  Y2K  compliant, 
and  then  they  are  moving  immediately  to  buy  or  replace  that  bio- 
medical equipment. 

I  just  mention  this,  because  this  gets  back  to  the  point  that  Ad- 
ministrator DeParle  mentioned.  It  is  absolutely  essential  that  the 
hospitals  and  the  clinics  and  our  community  health  centers,  and 
again  our  Indian  Health  Service,  for  example,  get  out  there  and  do 
this  work  themselves. 

We  cannot,  the  Federal  Government,  cannot  go  in  and  do  an  in- 
ventory for  them.  They  have  to  do  it.  Once  they  do  it,  we  feel  we 
will  have  sufficient  information  against  which  they  can  assess  their 
biomedical  situation. 
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Second,  they  have  to  get  with  their  vendors  too.  They  have  to  say 
I  have  this  biomedical  equipment,  get  on  the  phone  with  the  ven- 
dors and  ask  is  this  Y2K  compliant.  I  would  ask  them  to  test  it. 
So  it  is  a  big  job,  and  we  have  a  central  role  to  play  in  it,  but  it 
is  also  important  for  the  providers  to  do  their  work. 

Mr.  Turner.  Thank  you. 

Mr.  Horn.  Now  I  yield  5  minutes  to  the  vice  chairman  of  the 
Subcommittee  on  Government  Management,  Information,  and 
Technology,  Mrs.  Biggert  of  Illinois. 

Mrs.  Biggert.  Thank  you,  Mr.  Chairman. 

Ms.  DeParle,  do  you  think  that  there  is  any  concern  on  the  part 
of  providers  that  liability  issues  are  impacting  their  progress,  or  ei- 
ther whether  they  are  going  to  work  harder  to  comply  or  whether 
just  not  to  do  anything,  and  that  they  might  not  have  the  same  li- 
ability? Is  this  an  issue?  Are  they  concerned  about  liability  because 
of  failures  of  the  programs? 

Ms.  DeParle.  Well,  we  have  been  mainly  relying  on  outside  as- 
sessments that  have  been  done  of  provider  readiness.  There  is  a 
group  called  RX  2000  that  we  commissioned  to  do  a  study.  The  In- 
spector General  at  our  Department  has  also  done  a  targeted  study 
of  Medicare  providers  that  I  think  she  will  be  releasing  shortly. 

I  don't  know  if  that  issue  has  come  to  the  forefront  as  much  as 
I  do  have  some  anecdotal  evidence  that  some  providers  have  been 
concerned.  As  I  mentioned  to  the  chairman,  it  was  an  issue  for  me 
personally  about  our  contractors  when  I  first  said  I  wanted  the  con- 
tractors to  sign  a  contract  amendment. 

There  is  a  lot  of  concern,  there  has  been  a  lot  of  concern  about 
liability.  I  hear  it  from,  for  example,  managed  care  plans  that  I 
have  talked  to,  that  they  are  concerned  about — we  have  asked 
them  to  sign  a  contract  amendment  certifying  they  are  going  to  be 
ready  to  pay  managed  care  payments.  Some  of  them  are  concerned 
about  it. 

I  think  that  the  work  that  this  committee  and  the  Congress  have 
done  in  trying  to  alleviate  some  of  those  concerns  has  helped,  but 
I  think  it  is  still  an  issue  out  there. 

Mrs.  Biggert.  Thank  you.  I  might  ask  Mr.  Callahan  too,  as  far 
as  the  payment  management  system,  are  there  implications  with 
the  contractor  departments.  You  do  all  this  for  all  the  different 
Federal  agencies  like  the  Department  of  Labor  and  NASA.  Are 
there  implications  for  them  as  well  as  if  there  are  payments  within 
your  payment  management  system? 

Mr.  Callahan.  Again,  a  couple  of  points.  We  are  very  confident 
that,  given  the  information  I  have  mentioned  to  you  earlier,  we  will 
be  fully  compliant  with  the  legacy  payment  management  system  in 
June  of  this  year.  At  the  same  time,  we  will  also,  as  we  have,  we 
will  provide  you  with  the  contingency  plans  that  will  ensure  that 
all  the  grantees,  whether  they  are  in  our  own  Department  or  out 
in  the  States  or  localities,  will  receive  their  money  on  time. 

There  may  be  an  issue,  for  example,  on  a  contingency  plan,  as 
I  mentioned  to  you  earlier  since  the  payment  management  system 
is  just  in  time  payment,  if  you  will.  It  helps  prevent  a  float.  That 
is,  we  don't  give  money  to  the  States  that  they  don't  spend  that  we 
could  have  earned  interest  on. 
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But  obviously,  if  we  get  to  a  point  where  we  have  to  have  some 
contingency  plans  and  maybe  deliver  payments  in  less  than  just  in 
time,  we  may  have  to  suggest  waiving  some  of  the  provisions  of  the 
Cash  Management  Act.  But  I  think  we  will  know  exactly  once  the 
2000  appropriations  are  passed  exactly  what  all  these  agencies  will 
need  by  way  of  grants,  and  we  will  make  sure  that  they  get  those 
grants. 

Mrs.  BlGGERT.  Thank  you.  Mr.  Willemssen,  do  you  see  this  as  a 
growing  concern? 

Mr.  Willemssen.  Yes.  It  has  been  a  growing  concern.  It  is  a  con- 
cern that  was  attempted  to  be  addressed  with  the  Readiness  Dis- 
closure Act  that  was  passed  late  last  year.  I  think  this  spring  there 
will  have  to  be  a  reassessment  of  the  success  of  that  act,  and  if  in- 
deed it  has  allowed  more  disclosure  of  information.  One  thing  we 
will  be  particularly  looking  at  is  Mr.  Koskinen's  early  April  report 
on  the  readiness  of  all  the  key  sectors  in  our  country.  To  the  extent 
that  we  begin  to  see  much  more  detailed  rich  data  on  the  readiness 
of  those  sectors,  I  think  that  can  be  used  as  a  measure  of  the  suc- 
cess of  that  act.  To  the  extent  we  do  not  see  that,  then  I  think 
there  will  need  to  be  a  reassessment  of  whether  additional  legisla- 
tive action  is  necessary. 

Mrs.  BlGGERT.  Thank  you.  Thank  you,  Mr.  Chairman. 

Mr.  Horn.  Thank  you.  I  want  to  go  to  a  very  broad  question,  and 
I  need  to  know  who  is  the  senior  one  in  chronology  in  the  Depart- 
ment. Mr.  Secretary,  when  did  you  join  HHS? 

Mr.  Callahan.  I  joined  in  May  1995  and  was  confirmed  in  Au- 
gust 1995. 

Mr.  Horn.  Well,  you  are  all  innocent,  but  I  am  going  to  put  the 
question  anyhow.  Social  Security  realized  there  was  a  real  problem 
with  the  year  2000  back  in  1989.  When  we  were  drafting  Medicare, 
Social  Security  was  the  model  which  was  used  to  draft  Medicare. 
The  Secretary  was  involved,  the  Commissioner  of  Social  Security. 
Social  Security  in  the  sixties  was  regarded  as  the  best  managed 
agency  in  Washington,  DC.  I  think  it  still  has  a  lot  of  that  reputa- 
tion. 

But  I  am  curious  if  maybe  you  just  know  anecdotally,  when  So- 
cial Security,  which  was  then  under  HHS,  started  doing  this,  why 
wasn't  there  somebody  in  Medicare,  and  this  is  long  before  the  cur- 
rent Administrator's  tenure,  but  why  didn't  somebody  say  gee,  we 
ought  to  do  that  too? 

Mr.  Callahan.  Well,  I  can't  answer  that  question  directly  and 
fully,  but  let  me  offer  one  observation.  Social  Security  and  HCFA 
are  really  two  different  organizations,  as  you  know. 

Mr.  Horn.  Right. 

Mr.  Callahan.  Social  Security,  to  their  credit,  retains  a  large  di- 
rect service  delivery  structure  through  their  offices,  they  retain 
probably  one  of  the  best  information  technology  work  forces  inside 
their  agency.  I  had  the  pleasure  of  working  with  them.  They  are 
first  rate  people,  and  there  is  a  critical  mass  of  information  tech- 
nology people  that  enables  them  to  get  the  good  marks  that  you 
give  them. 

HCFA,  on  the  other  hand,  has  to  rely,  as  Administrator  DeParle 
has  said'  on  contractors  to  do  a  lot  of  their  work.  This  was  some- 
thing that  was  established  in  legislation,  and,  as  you  know,  we 
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have  had  discussions  about  the  relationship  between  HCFA  and  its 
contractors.  So  I  would  just  say  they  were  two  different  organiza- 
tions. 

I  would  also  offer  the  observation  that  Social  Security  had  the 
structure  and  critical  mass  of  people  to  succeed  at  a  quicker  rate 
on  this,  no  matter  when  the  decision  was  made,  than  possibly  the 
Health  Care  Financing  Administration,  with  no  disrespect  to  the 
current  Administrator  or  previous  Administrators. 

Mr.  Horn.  Let  me  just  try  to  focus  in  now,  just  to  get  in  one 
place  in  the  record  the  legacy  payment  management  system.  As  I 
understand  it,  in  November  1998  you  said  you  would  think  the 
code  was  all  remediated  by  that  time,  and  I  think  you  said  they 
would  be  year  2000  compliant  by  June  1999. 

I  guess  I  would  ask  the  question  of  how  much  did  the  original 
system,  which  is  still  there  until  assured  of  the  secondary  system, 
reengineered  though  it  might  be  to  see  that  that  is  compliant,  what 
are  we  talking  about  in  dollars? 

Mr.  Callahan.  We  have  spent,  it  is  my  understanding,  to  reme- 
diate the  code  on  the  legacy-based  system,  that  we  have  spent 
$850,000  on  that  remediation.  We  have  now,  on  the  basis  of  that, 
the  Avistar  report,  which  we  are  giving  to  the  committee  today,  in- 
dicates with  that  code,  that  remediated  code  in  place,  they  have 
given  us  the  milestones  and  the  particulars  to  go  through  the  re- 
maining processes  to  make  sure  it  is  certified  and  implemented, 
and  they  estimate  that  it  will  take  until  June  for  us  to  do  that. 

Mr.  Horn.  So  the  total  cost,  how  about  the  total  cost  of  the  pay- 
ment management  system? 

Mr.  Callahan.  The  other  system,  the  reengineered  payment  sys- 
tem that  we  want  to  eventually  get  to  

Mr.  Horn.  Well,  are  you  saying  that  the  total  cost  of  the  original 
system  that  you  are  still  working  with,  you  are  saying  that  is 
$850,000?  It  sounds  a  little  low  to  me. 

Mr.  Callahan.  That  system  has  been  in  operation  for  a  long  pe- 
riod of  time. 

Mr.  Horn.  What,  10  years? 

Mr.  Callahan.  I  am  not  exactly  sure,  but  probably  at  least  10 
years,  or  at  least  a  large  number  of  years.  So  there  has  been  no 
structural  work  on  that  other  than  it  operates  on  a  day-to-day 
basis.  But  when  we  get  to  the  situation  of  having  the  concern  that 
the  reengineered  payment  management  system  would  not  make 
the  Y2K  deadline,  we  went  back  and  looked  at  that  legacy  code  and 
had  it  remediated,  and  that  has  been  remediated.  That  cost  us 
$850,000  to  do  that. 

Mr.  Horn.  OK.  But  that  is  not  the  original  cost  of  the  system. 

Mr.  Callahan.  No.  The  original  cost  of  that  system,  I  will  have 
to  get  that  information  for  the  record. 

[The  information  referred  to  follows:] 

The  PMS  system  was  developed  over  a  five  year  period  from  1979-1984  at  a  cost 
of  approximately  $8  million. 
The  exact  cost  to  have  the  factory  remediate  the  legacy  code  was  $594,323. 

Mr.  Horn.  If  you  could.  What  I  am  going  to  leave  open  is  the 
questions  we  asked  about  this  now  and  since  you  just  gave  us  the 
document  today,  questions  that  we  will  send  down  to  you  and  we 
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will  put  without  objection,  the  whole  bunch  at  the  end  of  the  hear- 
ing. But  we  will  have  it  in  one  place. 

So  now  that  we  have  got  the  secondary  system  that  you  are  going 
to  move  to  when  you  can  be  assured  that  it  is  compliant,  what  is 
the  estimated  cost  on  that? 

Mr.  Callahan.  We  will  supply  that  for  the  record,  but  to  date 
we  have  spent  $6.7  million  on  that  since  1994. 

[The  information  referred  to  follows:] 

The  estimated  cost  to  have  the  system  deployable  is  $10  million  (in  round  num- 
bers) and  includes  the  $6.7  million  already  expended. 

Mr.  Horn.  Since  1994.  That  is  the  secondary  system. 
Mr.  Callahan.  Yes. 

Mr.  HORN.  OK.  Now,  was  your  original  payment  management 
system  approved  by  the  appropriate  authorization  committee  and 
appropriations  subcommittee? 

Mr.  Callahan.  I  will  have  to  get  that  information  for  the  record. 

[The  information  referred  to  follows:] 

PMS  was  not  the  "original"  grants  payment  system  in  HHS.  It  was  a  third-gen- 
eration system  preceded  by  the  Departmental  Federal  Assistance  Financing  System 
(DFAFS)  and  the  NIH  Grants  Payment  System  (GPS).  The  GPS  originated  in  the 
sixties  and  operated  with  funds  appropriated  for  normal  administrative  activities. 
Therefore,  there  was  no  formal  request  of  special  appropriated  funds  for  a  "new" 
system.  The  funds  for  the  PMS  upgrade  were  included  in  our  budget  requests  and 
were  appropriated  accordingly. 

Mr.  HORN.  I  take  it  you  billed  your  customers  to  try  to  cover  the 
cost? 

Mr.  Callahan.  Yes. 

Mr.  Horn.  What  kind  of  money  are  we  talking  about? 

Mr.  Callahan.  You  mean  our  annual  inflow? 

Mr.  HORN.  What  is  your  annual  revenue  for  serving  people  in  the 
rest,  the  executive  branch? 

Mr.  Callahan.  I  will  get  that  for  the  record,  the  actual  dollar, 
but  I  will  tell  you  the  fees  for  this  are  extremely  low,  because  in 
essence  we  provide  not  only  the  just  in  time  service,  but  we  rec- 
oncile the  accounts  so  there  is  no  Cash  Management  Improvement 
Act  problems.  That  is,  the  agency  doesn't  have  to  pay  interest  to 
the  States  or  vice  versa. 

[The  information  referred  to  follows:] 

The  total  revenue  for  FY98  was  $9,076,927. 

Mr.  Horn.  There  is  $170  million  a  year  flowing  through  that  sys- 
tem, is  that  correct? 

Mr.  Callahan.  $165,  I  think  it  is,  or  $170.  I  will  get  the  precise 
amount. 

[The  information  referred  to  follows:] 
The  precise  number  is  $165,710,740,000  or  166  billion. 

Mr.  HORN.  OK.  Have  you  kept  those  records?  Is  that  part  of  your 
accounting  system? 
Mr.  Callahan.  Yes. 

Mr.  HORN.  Now,  how  different  is  it  or  how  similar  is  it  to  the  Fi- 
nancial Management  Service  within  the  Department  of  the  Treas- 
ury and  the  center  in  New  Orleans  of  the  Department  of  Agri- 
culture that  some  other  departments  use? 
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Mr.  Callahan.  Vis-a-vis  the  Treasury  system,  it  has  additional 
functionalities,  the  current  system  and  the  future  system  have 
functionalities  like  Cash  Management  Improvement  Act  capabili- 
ties that  the  Treasury  system  does  not  have.  There  are  other  agen- 
cies right  now  that,  for  example,  the  Department  of  Education  has 
its  own  grant  payment  management  system.  The  Council  of  Chief 
Financial  Officers  has  in  response  to  State  officials  who  don't  like 
all  these  different  grant  payment  systems  working,  recommended 
that  only  two  systems  be  used,  the  Treasury  ASAP  system  and  the 
HHS  payment  management  system.  So  we  have  gone  out  and 
worked  with  each  of  the  agencies.  They  will  be  making  their 
choices  over  time. 

So  at  some  point  down  the  line,  it  appears  that  there  will  be  only 
two  payment  management  systems  run  by  the  Federal  Govern- 
ment, the  Treasury  system  and  our  system. 

Mr.  Horn.  Now,  the  Treasury  system  runs  the  Social  Security 
checks,  is  that  not  correct? 

Mr.  Callahan.  Social  Security  

Mr.  Horn.  Financial  Management  Service. 

Mr.  Callahan.  Yes,  that  goes  to  the  Financial  Management 
Service.  I  am  not  sure  that  is  ASAP,  which  is  their  grant  payment 
system.  I  have  to  check  on  that. 

Mr.  Horn.  I  am  just  curious.  So  each  Cabinet  Secretary  has  a 
right  to  make  a  choice  as  to  where  they  will  get  the  best  service? 

Mr.  Callahan.  Yes. 

Mr.  Horn.  Is  some  of  that  related  to  the  actual  cost? 
Mr.  Callahan.  Yes. 

Mr.  Horn.  Are  you  the  cheapest  deal  in  town? 
Mr.  Callahan.  We  think  we  are  the  best  deal  in  town. 
Mr.  Horn.  I  know  you  think  you  are  the  best.  The  most  reason- 
able rate  that  you  charge. 
Mr.  Callahan.  Right. 

Mr.  Horn.  Well,  we  are  interested  in  that,  just  to  make  sure  it 
is  on  line.  We  are  interested  in  the  compliant  bit,  and  I  think  if 
you  can  all  agree  on  what  is  the  appropriate  test,  we  will  know  in 
the  next  round  if  something  really  was  remediated. 

Mr.  Callahan.  Yes,  sir. 

Mr.  Horn.  Let  me  just  make  a  few  comments.  We  have  had  some 
very  fine  testimony  this  morning  that  has  clarified  a  number  of 
things  for  us.  The  fact  is,  millions  of  American  citizens  rely  on 
Health  and  Human  Services  and  your  very  critical  services.  We  all 
know  that  Medicare  is  just  one  of  the  key  things  in  this  society. 
When  you  think  back  what  this  country  would  be  like  if  we  hadn't 
had  Medicare  established  in  1965,  you  would  realize  that  this  is 
one  of  the  major  laws  of  the  20th  century. 

We  are  going  to  continue  to  monitor  the  Department's  progress 
to  develop  the  new  system  on  the  legacy  system,  and  we  will  maybe 
have  a  future  hearing  on  all  of  those  types  of  operations  in  the  ex- 
ecutive branch. 

However,  I  remain  concerned  about  the  Health  Care  Financing 
Administration's  external  mission  critical  systems  that  were  re- 
cently reported  as  being  2000  compliant.  I  am  assuming  GAO  and 
you  will  get  agreement  on  this  by  the  next  round,  because  to  me 
"compliant"  means  compliant,  not  compliant  with  qualifications. 
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But  I  thank  you  both  from  the  Department  for  your  testimony, 
and  I  thank  the  General  Accounting  Office  and  all  of  your  associ- 
ates for  your  testimony.  I  think  we  are  making  progress  as  a  result 
of  the  cooperation  we  have  had  within  the  executive  branch  and 
with  GAO.  I  think  this  morning,  however,  we  still  have  a  lot  to  do, 
and  that  from  some  of  the  questions  Mrs.  Morella  asked  it  is  really 
a  thing  that  both  the  legislative  branch  and  executive  branch  have 
to  do,  which  is  get  the  word  out  to  the  people,  so  we  don't  have  a 
lot  of  corner  cutters  and  book  writers  that  are  trying  to  scare  the 
living  daylights  out  of  the  American  public. 

This  is  a  solvable  problem.  You  have  shown,  even  though  you 
have  come  to  this  late,  but  you  certainly  turned  a  lot  of  that  agency 
around  in  terms  of  getting  the  remediation  underway,  and  we  ap- 
preciate that.  That  good  word  needs  to  go  out.  The  more  TV  shows, 
radio  shows,  Q  and  A  you  can  answer,  and  I  know  that  is  tough, 
that  is  very  important,  because  every  little  bit  helps. 

If  there  are  no  further  questions  from  any  of  my  colleagues,  with 
that,  this  hearing  is  adjourned. 

The  staff  list  I  will  put  in  the  record.  Just  for  the  record,  J.  Rus- 
sell George,  the  staff  director  and  chief  counsel;  Matt  Ryan,  to  my 
left,  senior  policy  director;  Bonnie  Heald,  director  of  information; 
Mason  Alinger,  clerk;  Paul  Wicker,  Kacey  Baker  and  Richard 
Lukas,  interns;  Michelle  Ash,  minority  counsel;  Faith  Weiss,  minor- 
ity professional  staff  member  and  counsel;  Earley  Green,  minority 
staff  ssistant;  and  then  the  court  reporters,  Doreen  Dotzler,  Cindy 
Sebo  and  Bob  Cochran,  who  is  faithfully  writing  down  to  the  last 
second. 

Thank  you,  Bob. 

[Whereupon,  at  11:10  a.m.,  the  subcommittee  was  adjourned.] 
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